NVD

Id
29003  
Name
CVE-2014-0060  
Description
PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-03-31  
Modified Date
2017-01-06  
Seq
2014-0060  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
152955 29003 CVE-2014-0060 APPLE-SA-2014-10-16-3  View
152956 29003 CVE-2014-0060 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705  View
152957 29003 CVE-2014-0060 RHSA-2014:0469  View
152958 29003 CVE-2014-0060 61307  View
152959 29003 CVE-2014-0060 http://support.apple.com/kb/HT6448  View
152960 29003 CVE-2014-0060 http://wiki.postgresql.org/wiki/20140220securityrelease  View
152961 29003 CVE-2014-0060 DSA-2864  View
152962 29003 CVE-2014-0060 DSA-2865  View
152963 29003 CVE-2014-0060 http://www.postgresql.org/about/news/1506/  View
152964 29003 CVE-2014-0060 https://support.apple.com/kb/HT6536  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
12968 JVNDB-2014-001843 PostgreSQL におけるロールに任意のユーザを追加または削除される脆弱性 PostgreSQL は、ADMIN OPTION の制限を適切に適用しないため、ロールに任意のユーザを追加または削除される脆弱性が存在します。 CVE-2014-0060 67461 CVE-2014-0060 29003 4 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-001843.html 2014-02-20 2015-08-10 View