N/A

A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code. An attacker having only the unprivileged Windows account can read arbitrary data directory files, essentially bypassing database-imposed read access limitations. An attacker having only the unprivileged Windows account can also delete certain data directory files.

N/A

访问控制不恰当

PostgreSQL 访问控制错误漏洞

PostgreSQL是Postgresql组织的一套自由的对象关系型数据库管理系统。该系统支持大部分SQL标准并且提供了许多其他特性，例如外键、触发器、视图等。 PostgreSQL中存在访问控制错误漏洞，该漏洞源于EnterpriseDB Windows安装程序没有锁定PostgreSQL二进制安装路径和数据路径的权限。攻击者可利用该漏洞执行任意代码。

N/A

N/A