CVE-2022-2625

Name of the Vulnerable Software and Affected Versions PostgreSQL (affected versions not specified)

Description A vulnerability was found in PostgreSQL that allows an attacker to run arbitrary code as the victim role, which may be a superuser. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. The flaw is related to errors when using OR commands with extensions, which can allow a remote attacker to elevate their privileges and replace arbitrary objects in the database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.