CVE-2014-0060

PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION…

published March 28, 2014

CVSS
—
EPSS
4%
Percentile
90.8
In the wild
Unconfirmed
What it is

PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04124 · 90.8th percentile
Published
2014-03-28T17:00Z
EPSS history
Timeline
  • 28 MAR 17:00Z
    PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION…
    cvelistv5