Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
PostgreSQL Permissions Privileges and Access Controls Vulnerability - CVE-2012-3488 - Vulnerability Database
PostgreSQL

PostgreSQL Permissions Privileges and Access Controls Vulnerability - CVE-2012-3488

Medium
Reference: CVE-2012-3488
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2012-3488
Title: PostgreSQL Permissions Privileges and Access Controls Vulnerability
Overview:

The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20 8.4 before 8.4.13 9.0 before 9.0.9 and 9.1 before 9.1.5 does not properly restrict access to files and URLs which allows remote authenticated users to modify data obtain sensitive information or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature related to an XML External Entity (aka XXE) issue.