PT-2022-16482
CVE-2022-24128
·
تاريخ النشر
2022-03-13
·
تاريخ التحديث
2025-03-04
الوصف من
CVSS 3.1
8.0
عاليةالمقاييسAV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
TimescaleDB versions 1.x and 2.x before 2.5.2
Description
The issue allows privilege escalation during extension installation. An unprivileged user can precreate objects using commands like
CREATE which will be used by the installer executing as Superuser. To exploit this, an unprivileged user needs to create objects in a database and then have a Superuser install TimescaleDB into their database.Recommendations
For versions 1.x and 2.x before 2.5.2, update to version 2.5.2 or later to resolve the issue.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾