CVE-2016-6656: pivotal_software greenplum Command Injection

Vulnerability summary

CVE-2016-6656 is a high (CVSS 7.2) Command Injection vulnerability in pivotal_software greenplum. EPSS estimates a 1.11% chance of exploitation in the next 30 days, higher than 65.4% of scored vulnerabilities.

Timeline

1. 16-12-2016
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in Pivotal Greenplum before 4.3.10.0. Creation of external tables using GPHDFS protocol has a vulnerability whereby arbitrary commands can be injected into the system. In order to exploit this vulnerability the user must have superuser 'gpadmin' access to the system or have been granted GPHDFS protocol permissions in order to create a GPHDFS external table.

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.