Home > Vulnerability Database > CVE-2012-3488

Mend.io Vulnerability Database

CVE-2012-3488

Good to know:

Date: October 3, 2012

The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue.

Language: C

Severity Score

4.2

Related Resources (28)

Url: http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html

Url: http://rhn.redhat.com/errata/RHSA-2012-1263.html

Url: http://www.mandriva.com/security/advisories?name=MDVSA-2012:139

Url: http://www.postgresql.org/docs/8.3/static/release-8-3-20.html

Url: http://secunia.com/advisories/50946

Url: https://bugzilla.redhat.com/show_bug.cgi?id=849172

Url: http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html

Url: http://www.postgresql.org/docs/8.4/static/release-8-4-13.html

Url: http://www.postgresql.org/support/security/

Url: http://www.ubuntu.com/usn/USN-1542-1

Url: https://access.redhat.com/security/cve/CVE-2012-3488

Url: http://www.debian.org/security/2012/dsa-2534

Url: https://nvd.nist.gov/vuln/detail/CVE-2012-3488

Url: http://www.postgresql.org/about/news/1407/

Url: http://www.securityfocus.com/bid/55072

Url: http://www.postgresql.org/docs/9.0/static/release-9-0-9.html

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2012-3488

Url: http://secunia.com/advisories/50636

Url: http://rhn.redhat.com/errata/RHSA-2012-1264.html

Url: https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2

Url: http://www.postgresql.org/docs/9.1/static/release-9-1-5.html

Url: http://secunia.com/advisories/50635

Url: http://secunia.com/advisories/50718

Url: http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html

Url: http://secunia.com/advisories/50859

Url: http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html

Url: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

Url: https://www.mend.io/vulnerability-database/CVE-2012-3488

Severity Score

4.2

Weakness Type (CWE)

Permissions, Privileges, and Access Control

CWE-264

Top Fix

Upgrade Version

Upgrade to version 8.3.20,8.4.13,9.0.9,9.1.5

Learn More

CVSS v3.1

Base Score:	4.2
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	4.9
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	SINGLE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2012-3488

Good to know:

Date: October 3, 2012

Language: C

Severity Score

Related Resources (28)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?