Vulnerability in Pgpool Pgpool-Ii
CVE-2023-22332
Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series. A specific database user's authentication information may be obtained by another database user. As a result, the information stored in the database may be altered and/or database may be suspended by a remote attacker who successfully logged in the product with the obtained credentials.
EPSS: 0.007 (49.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Pgpool Pgpool-ii
- Pgpool Global Development Group Pgpool-ii — versions 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series
Weakness classification (CWE)
References
- vultures@jpcert.or.jp (Vendor Advisory)
- vultures@jpcert.or.jp (Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2023-22332?
- CVE-2023-22332 is a medium-severity vulnerability in Pgpool Pgpool-Ii, classified under Cleartext Storage of Sensitive Information. CVSS score: 6.5/10. Published 2023-01-30.
- How severe is CVE-2023-22332?
- Medium severity. CVSS v3 base score is 6.5 out of 10.