CVE-2012-3488: postgresql

CVSS: 4.9v2.0MediumModified

AliasesRHSA-2012:1264

Published 03-10-2012Last modified 06-08-2024

Vulnerability summary

CVE-2012-3488 is a medium (CVSS 4.9) vulnerability in postgresql. EPSS estimates a 3.30% chance of exploitation in the next 30 days, higher than 88.3% of scored vulnerabilities.

Overall risk

20/100

0100

Low · default modelHow is this calculated?

CVSS score

4.9/10

010

Medium · v2.0 (NVD)

EPSS score

3.30%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 3

DSA-2534-1 OPENSUSE-SU-2024:10030-1 OPENSUSE-SU-2024:10256-1 OPENSUSE-SU-2024:10273-1 RHSA-2012:1263

Timeline

03-10-2012
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue.

CVSS metrics

1 score · 1 source · 1 version

v2.04.9

EPSS trend

Probability

3.30%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

0.00 pp

From 3.30% on 20-09-2026

20-09-202620-10-2026

EPSS score

3.30%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected systems

Redhat11 products

postgresql< 0:8.1.23-6.el5_8
postgresql-contrib< 0:8.1.23-6.el5_8
postgresql-debuginfo< 0:8.1.23-6.el5_8
postgresql-devel< 0:8.1.23-6.el5_8
postgresql-docs< 0:8.1.23-6.el5_8

Show all 11

Postgresql1 product

postgresqlEOL9.1 | 9.1.1 | 9.1.2 | 9.1.3 | 9.1.4 | 8.4 | 8.4.1 | 8.4.2 | 8.4.3 | 8.4.4 | 8.4.5 | 8.4.6 | 8.4.7 | 8.4.8 | 8.4.9 | 8.4.10 | 8.4.11 | 8.4.12 | 8.3 | 8.3.1 | 8.3.2 | 8.3.3 | 8.3.4 | 8.3.5 | 8.3.6 | 8.3.7 | 8.3.8 | 8.3.9 | 8.3.10 | 8.3.11 | 8.3.12 | 8.3.13 | 8.3.14 | 8.3.15 | 8.3.16 | 8.3.17 | 8.3.18 | 8.3.19 | 9.0 | 9.0.1 | 9.0.2 | 9.0.3 | 9.0.4 | 9.0.5 | 9.0.6 | 9.0.7 | 9.0.8

2 vendors · 12 products