CVE-2020-1720: postgresql Improper Authorization
Vulnerability summary
CVE-2020-1720 is a medium (CVSS 6.5) Improper Authorization vulnerability in postgresql. EPSS estimates a 1.18% chance of exploitation in the next 30 days, higher than 67.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 17 · Related 5Timeline
- 17-03-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.
CVSS metrics
6 scores · 5 sources · 2 versions- CVE.orgCNA3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · Red hatEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
1.18%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
0.00 pp
From 1.18% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Suse82 products
- postgresql10-libs&distro=HPE Helion OpenStack 8< 10.12-1.18.1
- postgresql10-libs&distro=SUSE Enterprise Storage 5< 10.12-1.18.1
- postgresql10-libs&distro=SUSE Linux Enterprise Desktop 12 SP4< 10.12-1.18.1
- postgresql10-libs&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 10.12-1.18.1
- postgresql10-libs&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 10.12-1.18.1
Redhat39 products
- decision_manager7.0
- enterprise_linux8.0
- software_collectionsna
- ovirt-engine< 0:4.3.10.3-0.2.el7
- ovirt-engine-backend< 0:4.3.10.3-0.2.el7
Alpine3 products
- postgresql≥ 9.6, < 11.7-r0 | ≥ 9.6, < 12.2-r0 | ≥ 9.6, < 10.12-r0
- postgresql14< 12.2-r0
- postgresql15< 12.2-r0
Debian3 products
- postgresql-11< 11.7-0+deb10u1
- postgresql-9.4< 9.4.26-0+deb8u1
- postgresql-9.6< 9.6.17-0+deb9u1
Mageia2 products
- postgresql11< 11.7-1.mga7
- postgresql9.6< 9.6.17-1.mga7
Opensuse1 product
- postgresql10&distro=openSUSE Leap 15.1< 10.12-lp151.2.9.1
Postgresql1 product
- postgresql≥ 9.6, < 9.6.17 | ≥ 10.0, < 10.12 | ≥ 11.0, < 11.7 | ≥ 12.0, < 12.2
Red hat1 product
- postgresql12.2 | 11.7 | 10.12 | 9.6.17
Ubuntu1 product
- postgresql-10< 10.12-0ubuntu0.18.04.1
9 vendors · 133 products
References
36 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1720X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
Show all 36 references
- lists.opensuse.org/archives/…Advisory