Search criteria

3 vulnerabilities found for PgpoolAdmin by PgPool Global Development Group

CVE-2018-16203 (GCVE-0-2018-16203)

Vulnerability from cvelistv5 – Published: 2019-01-09 22:00 – Updated: 2024-08-05 10:17
VLAI
Summary
PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unspecified vectors.
Severity
No CVSS data available.
CWE
  • Fails to restrict access
Assigner
References
URL Tags
https://pgpool.net/mediawiki/index.php/Main_Page x_refsource_MISC
https://jvn.jp/en/jp/JVN13199224/index.html third-party-advisoryx_refsource_JVN
Impacted products
Date Public
2019-01-09 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:17:38.333Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://pgpool.net/mediawiki/index.php/Main_Page"
          },
          {
            "name": "JVN#13199224",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN13199224/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PgpoolAdmin",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.0 and earlier"
            }
          ]
        }
      ],
      "datePublic": "2019-01-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Fails to restrict access",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-01-09T21:57:01.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://pgpool.net/mediawiki/index.php/Main_Page"
        },
        {
          "name": "JVN#13199224",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN13199224/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2018-16203",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PgpoolAdmin",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.0 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "PgPool Global Development Group"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Fails to restrict access"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://pgpool.net/mediawiki/index.php/Main_Page",
              "refsource": "MISC",
              "url": "https://pgpool.net/mediawiki/index.php/Main_Page"
            },
            {
              "name": "JVN#13199224",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN13199224/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2018-16203",
    "datePublished": "2019-01-09T22:00:00.000Z",
    "dateReserved": "2018-08-30T00:00:00.000Z",
    "dateUpdated": "2024-08-05T10:17:38.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-16203 (GCVE-0-2018-16203)

Vulnerability from nvd – Published: 2019-01-09 22:00 – Updated: 2024-08-05 10:17
VLAI
Summary
PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unspecified vectors.
Severity
No CVSS data available.
CWE
  • Fails to restrict access
Assigner
References
URL Tags
https://pgpool.net/mediawiki/index.php/Main_Page x_refsource_MISC
https://jvn.jp/en/jp/JVN13199224/index.html third-party-advisoryx_refsource_JVN
Impacted products
Date Public
2019-01-09 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:17:38.333Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://pgpool.net/mediawiki/index.php/Main_Page"
          },
          {
            "name": "JVN#13199224",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN13199224/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PgpoolAdmin",
          "vendor": "PgPool Global Development Group",
          "versions": [
            {
              "status": "affected",
              "version": "4.0 and earlier"
            }
          ]
        }
      ],
      "datePublic": "2019-01-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Fails to restrict access",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-01-09T21:57:01.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://pgpool.net/mediawiki/index.php/Main_Page"
        },
        {
          "name": "JVN#13199224",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN13199224/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2018-16203",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "PgpoolAdmin",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.0 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "PgPool Global Development Group"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Fails to restrict access"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://pgpool.net/mediawiki/index.php/Main_Page",
              "refsource": "MISC",
              "url": "https://pgpool.net/mediawiki/index.php/Main_Page"
            },
            {
              "name": "JVN#13199224",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN13199224/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2018-16203",
    "datePublished": "2019-01-09T22:00:00.000Z",
    "dateReserved": "2018-08-30T00:00:00.000Z",
    "dateUpdated": "2024-08-05T10:17:38.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

JVNDB-2018-000134

Vulnerability from jvndb - Published: 2018-12-21 14:10 - Updated:2019-08-27 17:41
Severity
9.8 (Critical) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
PgpoolAdmin fails to restrict access permissions
Details
PgpoolAdmin provided by PgPool Global Development Group fails to restrict access permissions (CWE-264). Fotios Rogkotis of DarkMatter reported this vulnerability to PgPool Global Development Group, and PgPool Global Development Group reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and PgPool Global Development Group coordinated under the Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000134.html",
  "dc:date": "2019-08-27T17:41+09:00",
  "dcterms:issued": "2018-12-21T14:10+09:00",
  "dcterms:modified": "2019-08-27T17:41+09:00",
  "description": "PgpoolAdmin provided by PgPool Global Development Group fails to restrict access permissions (CWE-264).\r\n\r\nFotios Rogkotis of DarkMatter reported this vulnerability to PgPool Global Development Group, and PgPool Global Development Group reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and PgPool Global Development Group coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000134.html",
  "sec:cpe": {
    "#text": "cpe:/a:pgpool:pgpooladmin",
    "@product": "PgpoolAdmin",
    "@vendor": "PgPool Global Development Group",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "7.5",
      "@severity": "High",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "9.8",
      "@severity": "Critical",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2018-000134",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN13199224/index.html",
      "@id": "JVN#13199224",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16203",
      "@id": "CVE-2018-16203",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-16203",
      "@id": "CVE-2018-16203",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "PgpoolAdmin fails to restrict access permissions"
}