NVD

Id
42931  
Name
CVE-2012-0866  
Description
CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER, which allows remote authenticated users to execute otherwise restricted triggers on arbitrary data by installing the trigger on an attacker-owned table.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2012-07-18  
Modified Date
2016-12-07  
Seq
2012-0866  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
216096 42931 CVE-2012-0866 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705  View
216097 42931 CVE-2012-0866 openSUSE-SU-2012:1173  View
216098 42931 CVE-2012-0866 RHSA-2012:0677  View
216099 42931 CVE-2012-0866 RHSA-2012:0678  View
216100 42931 CVE-2012-0866 DSA-2418  View
216101 42931 CVE-2012-0866 MDVSA-2012:026  View
216102 42931 CVE-2012-0866 MDVSA-2012:027  View
216103 42931 CVE-2012-0866 MDVSA-2012:092  View
216104 42931 CVE-2012-0866 http://www.postgresql.org/about/news/1377/  View
216105 42931 CVE-2012-0866 http://www.postgresql.org/docs/8.3/static/release-8-3-18.html  View
216106 42931 CVE-2012-0866 http://www.postgresql.org/docs/8.4/static/release-8-4-11.html  View
216107 42931 CVE-2012-0866 http://www.postgresql.org/docs/9.0/static/release-9-0-7.html  View
216108 42931 CVE-2012-0866 http://www.postgresql.org/docs/9.1/static/release-9-1-3.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
27525 JVNDB-2012-003232 PostgreSQL の CREATE TRIGGER における制限されたトリガを実行される脆弱性 PostgreSQL の CREATE TRIGGER は、トリガされる SECURITY DEFINER が付与された関数の実行権限を適切に確認しないため、任意のデータ上の制限されたトリガを実行される脆弱性が存在します。 CVE-2012-0866 54104 CVE-2012-0866 42931 6.5 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-003232.html 2012-02-27 2012-11-14 View