CVE-2023-22626

PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message

High · published January 5, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
57.4
In the wild
Unconfirmed
What it is

PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on database user privileges, this may only be information from the database, or may be information from file contents on the database server.)

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00840 · 57.4th percentile
Published
2023-01-05T00:00Z
EPSS history
Timeline
  • 05 JAN 00:00Z
    PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message
    cvelistv5