A remote code execution vulnerability was found within the pg...

9.8 CVSS

Vulnerability Description

A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-16082

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from HackerOne

View All →

CVE-2018-3787

Path traversal in simplehttpserver <v0.2.1 allows listing any file on...

High 7.5

CVE-2018-3779

active-support ruby gem 5.2.0 could allow a remote attacker to...

Critical 9.8

CVE-2018-3778

Improper authorization in aedes version <0.35.0 will publish a LWT...

Medium 5.3

CVE-2018-3776

Improper input validator in Nextcloud Server prior to 12.0.3 and...

Medium 5.3

CVE-2018-3775

Improper Authentication in Nextcloud Server prior to version 12.0.3 would...

High 8.8

Affected Vendor

HackerOne

View all reports →

Affected Software

pg node module

Vulnerable Versions:

< 2.11.2 || >= 3.0.0 < 3.6.4 || >= 4.0.0 < 4.5.7 || >= 5.0.0 < 5.2.1 || >= 6.0.0 < 6.0.5 || >= 6.1.0 < 6.1.6 || >= 6.2.0 < 6.2.5 || >= 6.3.0 < 6.3.3 || >= 6.4.0 < 6.4.2 || >= 7.0.0 < 7.0.2 || >= 7.1.0 < 7.1.2