PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2014-03-28T17:00:00
Updated: 2024-08-06T09:05:38.375Z
Reserved: 2013-12-03T00:00:00
Link: CVE-2014-0060
Vulnrichment
No data.
NVD
Status : Modified
Published: 2014-03-31T14:58:08.663
Modified: 2024-11-21T02:01:16.350
Link: CVE-2014-0060
Redhat