Descrição
Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker-s choice. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVSS 5.4EPSS 0.159%Risco 0.55
Ver fonte- Publicação
- 2026-05-14 14:16:24
- Versões afetadas
- <18.4,<17.10,<16.14,<15.18,<14.23
- Tipo
- Core software
- Vetor
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N