« Volver al listado

CVE-2023-22332

Estado: ModificadaMedia (6.5)—

Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series. A specific database user's authentication information may be obtained by another database user. As a result, the information stored in the database may be altered and/or database may be suspended by a remote attacker who successfully logged in the product with the obtained credentials.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pgpool — Pgpool-ii

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-22332",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-22332",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-28T14:06:17.841607Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "PgPool Global Development Group",
          "product": "Pgpool-II",
          "versions": [
            {
              "status": "affected",
              "version": "4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-01-30T07:15:10.003",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN72418815/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.pgpool.net/mediawiki/index.php/Main_Page#News",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN72418815/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00015.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.pgpool.net/mediawiki/index.php/Main_Page#News",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 series), 4.1.0 to 4.1.14 (4.1 series), 4.0.0 to 4.0.21 (4.0 series), All versions of 3.7 series, All versions of 3.6 series, All versions of 3.5 series, All versions of 3.4 series, and All versions of 3.3 series. A specific database user's authentication information may be obtained by another database user. As a result, the information stored in the database may be altered and/or database may be suspended by a remote attacker who successfully logged in the product with the obtained credentials."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de divulgación de información existe en Pgpool-II 4.4.0 a 4.4.1 (serie 4.4), 4.3.0 a 4.3.4 (serie 4.3), 4.2.0 a 4.2.11 (serie 4.2), 4.1.0 a 4.1. 14 (serie 4.1), 4.0.0 a 4.0.21 (serie 4.0), Todas las versiones de la serie 3.7, Todas las versiones de la serie 3.6, Todas las versiones de la serie 3.5, Todas las versiones de la serie 3.4 y Todas las versiones de la serie 3.3. La información de autenticación de un usuario de base de datos específico puede ser obtenida por otro usuario de base de datos. Como resultado, la información almacenada en la base de datos puede verse alterada y/o la base de datos puede ser suspendida por un atacante remoto que haya iniciado sesión exitosamente en el producto con las credenciales obtenidas."
    }
  ],
  "lastModified": "2026-06-17T05:35:05.513",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pgpool:pgpool-ii:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC6F9DF2-27FB-43BE-B4EB-5296C01BD28E",
              "versionEndIncluding": "3.7.12",
              "versionStartIncluding": "3.3.0"
            },
            {
              "criteria": "cpe:2.3:a:pgpool:pgpool-ii:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AEFBFF5E-DE69-4F94-B4BD-53C8C91CA850",
              "versionEndExcluding": "4.0.22",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:pgpool:pgpool-ii:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1800AB14-AF70-4D4D-8E3D-FCFC7790F1FC",
              "versionEndExcluding": "4.1.15",
              "versionStartIncluding": "4.1.0"
            },
            {
              "criteria": "cpe:2.3:a:pgpool:pgpool-ii:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D3373F7-66DD-4A05-B7AF-8ABEAF99F4F9",
              "versionEndExcluding": "4.2.12",
              "versionStartIncluding": "4.2.0"
            },
            {
              "criteria": "cpe:2.3:a:pgpool:pgpool-ii:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AA369670-DE4B-478A-87C8-57A60929B885",
              "versionEndExcluding": "4.3.5",
              "versionStartIncluding": "4.3.0"
            },
            {
              "criteria": "cpe:2.3:a:pgpool:pgpool-ii:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A6FBCE3-2494-4B70-A094-289DE7AC6D64",
              "versionEndExcluding": "4.4.2",
              "versionStartIncluding": "4.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}