CVE-2024-7348

NVD Published Date: August 08, 2024 at 01:15 PM
NVD Last Modified: August 12, 2024 at 03:54 PM
Download Patch
Vulnerability ID
CVE-2024-7348
Severity
HIGH
Severity Score
7.5
Summary
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.
References
Mitigation and Patches
Exploits
-
Metasploit Payload
-
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE ID
CWE-367

Recent Publish

CVE-2024-3659

2024-07 Dynamic Cumulative Update for Windows 10 Version 21H2 for ARM64-based Systems (KB5040427)

2024-07 Dynamic Cumulative Update for Windows 10 Version 21H2 for x64-based Systems (KB5040427)

2024-07 Dynamic Cumulative Update for Windows 10 Version 22H2 for ARM64-based Systems (KB5040427)

2024-07 Cumulative Update for Windows 10 Version 22H2 for x86-based Systems (KB5040427)

2024-07 Cumulative Update for Windows 10 Version 22H2 for x64-based Systems (KB5040427)

See SecOps Solution
in action

Schedule Demo
Agentless security for your infrastructure and applications - to build faster, more securely and in a fraction of the operational cost of other solutions
hello@secopsolution.com
+569-231-213
Compare
Qualys Cloud Agent Tenable Nessus Rapid7 InsightVM
Company
About Us Contact Career
Resources
CVE Windows KB Case Studies eBooks Policy Templates Blog Webinar
Try It
Patch Astra EPSS Calculator Contact Free Scan Schedule Demo Log In
© 2024  SecOps Solution, Inc.| Privacy Policy | Terms and Conditions .
Social Media :