CVE-2021-3515CWE-77

A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26

published June 1, 2021

CVSS
—
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. An attacker with CREATEDB privileges on a PostgreSQL server can craft a database name that allows execution of shell commands as the postgresql user when calling pglogical.create_subscription().

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00460 · 38.9th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2021-06-01T13:31Z
EPSS history
Timeline
  • 01 JUN 13:31Z
    A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26
    cvelistv5