NVD

Id
45081  
Name
CVE-2012-3488  
Description
The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue.  
Reject
 
CVSS Version
2  
CVSS Score
4.9  
Severity
Medium  
CVSS Base Score
4.9  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:N)  
Pub Date
2017-01-19  
Published
2012-10-03  
Modified Date
2016-12-07  
Seq
2012-3488  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
226051 45081 CVE-2012-3488 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705  View
226052 45081 CVE-2012-3488 APPLE-SA-2013-03-14-1  View
226053 45081 CVE-2012-3488 openSUSE-SU-2012:1251  View
226054 45081 CVE-2012-3488 openSUSE-SU-2012:1288  View
226055 45081 CVE-2012-3488 openSUSE-SU-2012:1299  View
226056 45081 CVE-2012-3488 RHSA-2012:1263  View
226057 45081 CVE-2012-3488 RHSA-2012:1264  View
226058 45081 CVE-2012-3488 DSA-2534  View
226059 45081 CVE-2012-3488 MDVSA-2012:139  View
226060 45081 CVE-2012-3488 http://www.postgresql.org/about/news/1407/  View
226061 45081 CVE-2012-3488 http://www.postgresql.org/docs/8.3/static/release-8-3-20.html  View
226062 45081 CVE-2012-3488 http://www.postgresql.org/docs/8.4/static/release-8-4-13.html  View
226063 45081 CVE-2012-3488 http://www.postgresql.org/docs/9.0/static/release-9-0-9.html  View
226064 45081 CVE-2012-3488 http://www.postgresql.org/docs/9.1/static/release-9-1-5.html  View
226065 45081 CVE-2012-3488 http://www.postgresql.org/support/security/  View
226066 45081 CVE-2012-3488 55072  View
226067 45081 CVE-2012-3488 USN-1542-1  View
226068 45081 CVE-2012-3488 https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2  View
226069 45081 CVE-2012-3488 https://bugzilla.redhat.com/show_bug.cgi?id=849172  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
29019 JVNDB-2012-004726 PostgreSQL の contrib/xml2 におけるデータを改ざんされる脆弱性 PostgreSQL の contrib/xml2 内の libxslt のサポート機能は、ファイルおよび URL へのアクセスを適切に制限しないため、データを改ざんされる、重要な情報を取得される、または外部の任意のホストに対するアウトバウンドトラフィックを誘発される脆弱性が存在します。 CVE-2012-3488 56726 CVE-2012-3488 45081 5.8 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-004726.html 2012-08-17 2013-04-02 View