ByteOS Network

NVD Vulnerability Details :

CVE-2018-25088

Modified

Source-cna@vuldb.com

Published At-18 Jul, 2023 | 13:15

Updated At-17 May, 2024 | 01:27

A vulnerability, which was classified as critical, was found in Blue Yonder postgraas_server up to 2.0.0b2. Affected is the function _create_pg_connection/create_postgres_db of the file postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py of the component PostgreSQL Backend Handler. The manipulation leads to sql injection. Upgrading to version 2.0.0 is able to address this issue. The patch is identified as 7cd8d016edc74a78af0d81c948bfafbcc93c937c. It is recommended to upgrade the affected component. VDB-234246 is the identifier assigned to this vulnerability.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	5.5	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Secondary	2.0	5.2	MEDIUM	AV:A/AC:L/Au:S/C:P/I:P/A:P

CPE Matches

blueyonder>>postgraas_server>>Versions before 2.0.0(exclusive)

cpe:2.3:a:blueyonder:postgraas_server:*:*:*:*:*:*:*:*

blueyonder>>postgraas_server>>2.0.0

cpe:2.3:a:blueyonder:postgraas_server:2.0.0:beta1:*:*:*:*:*:*

blueyonder>>postgraas_server>>2.0.0

cpe:2.3:a:blueyonder:postgraas_server:2.0.0:beta2:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-89	Primary	cna@vuldb.com

References

Hyperlink	Source	Resource
https://github.com/blue-yonder/postgraas_server/commit/7cd8d016edc74a78af0d81c948bfafbcc93c937c	cna@vuldb.com	Patch
https://github.com/blue-yonder/postgraas_server/releases/tag/v2.0.0	cna@vuldb.com	Release Notes
https://vuldb.com/?ctiid.234246	cna@vuldb.com	Permissions Required
https://vuldb.com/?id.234246	cna@vuldb.com	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History