CVE-2022-26520
postgresql-jdbc: Arbitrary File Write Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties
** EN DISPUTA ** En pgjdbc versiones anteriores a 42.3.3, un atacante (que controla la URL o las propiedades de jdbc) puede llamar a java.util.logging.FileHandler para escribir en archivos arbitrarios mediante las propiedades de conexión loggerFile y loggerLevel. Una situación de ejemplo es que un atacante podría crear un archivo JSP ejecutable bajo una root web de Tomcat. NOTA: la posición del proveedor es que no se presenta una vulnerabilidad de pgjdbc; en cambio, es una vulnerabilidad para cualquier aplicación que use el controlador pgjdbc con propiedades de conexión no confiables
A flaw was found in Postgres JDBC. This flaw allows an attacker to use a method to write arbitrary files through the connection properties settings. For example, an attacker can create an executable file under the server the application is running and make it a new part of the application or server.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-03-06 CVE Reserved
- 2022-03-07 CVE Published
- 2024-08-03 CVE Updated
- 2024-11-20 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-552: Files or Directories Accessible to External Parties
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-673j-qm5f-xpv8 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/pgjdbc/pgjdbc/pull/2454/commits/017b929977b4f85795f9ad2fa5de6e80978b8ccc | 2024-05-17 |
| URL | Date | SRC |
|---|---|---|
| https://jdbc.postgresql.org/documentation/changelog.html#version_42.3.3 | 2024-05-17 | |
| https://jdbc.postgresql.org/documentation/head/tomcat.html | 2024-05-17 | |
| https://www.debian.org/security/2022/dsa-5196 | 2024-05-17 | |
| https://access.redhat.com/security/cve/CVE-2022-26520 | 2022-10-06 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2064007 | 2022-10-06 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Postgresql Search vendor "Postgresql" | Postgresql Jdbc Driver Search vendor "Postgresql" for product "Postgresql Jdbc Driver" | >= 42.1.0 <= 42.1.4 Search vendor "Postgresql" for product "Postgresql Jdbc Driver" and version " >= 42.1.0 <= 42.1.4" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Jdbc Driver Search vendor "Postgresql" for product "Postgresql Jdbc Driver" | >= 42.3.0 < 42.3.3 Search vendor "Postgresql" for product "Postgresql Jdbc Driver" and version " >= 42.3.0 < 42.3.3" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0" | - |
Affected
| ||||||