CVE-2009-3230

Description

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.

Risk Information

Base Score

8.8

MODERATE

Vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.853

Associated Vulnerability

Vulnerability	OS Platform
Vulnerability CVE-2009-3229,CVE-2009-3230 are affected in Postgresql 8.4	Windows
Vulnerabilities CVE-2009-3230,CVE-2009-3229 are fixed in PostgreSQL 8.4.1	Windows
Vulnerabilities CVE-2009-3230,CVE-2009-3229,CVE-2009-3231 are fixed in PostgreSQL 8.3.8	Windows
Vulnerabilities CVE-2009-3230,CVE-2009-3229,CVE-2009-3231 are fixed in PostgreSQL 8.2.14	Windows
Vulnerabilities CVE-2009-3230 are fixed in PostgreSQL 8.1.18	Windows
Vulnerabilities CVE-2009-3230 are fixed in PostgreSQL 8.0.22	Windows
Vulnerabilities CVE-2009-3230 are fixed in PostgreSQL 7.4.26	Windows
Vulnerability CVE-2009-3229,CVE-2009-3230 are affected in Postgresql 8.4 (For Linux)	Linux
Vulnerabilities CVE-2009-3230,CVE-2009-3229 are fixed in PostgreSQL 8.4.1 (For Linux)	Linux
Vulnerabilities CVE-2009-3230,CVE-2009-3229,CVE-2009-3231 are fixed in PostgreSQL 8.3.8 (For Linux)	Linux
Vulnerabilities CVE-2009-3230,CVE-2009-3229,CVE-2009-3231 are fixed in PostgreSQL 8.2.14 (For Linux)	Linux
Vulnerabilities CVE-2009-3230 are fixed in PostgreSQL 8.1.18 (For Linux)	Linux
Vulnerabilities CVE-2009-3230 are fixed in PostgreSQL 8.0.22 (For Linux)	Linux
Vulnerabilities CVE-2009-3230 are fixed in PostgreSQL 7.4.26 (For Linux)	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234