Title : PostgreSQL Database SECURITY DEFINER Functions Privilege Escalation Vulnerability VUPEN ID : VUPEN/ADV-2007-1497 CVE ID : CVE-2007-2138
Rated as : Moderate Risk
Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2007-04-24
Technical Description
A vulnerability has been identified in PostgreSQL, which could be exploited by malicious users to obtain elevated privileges. This issue is caused by an insecure "search_path" settings, which could be exploited by unprivileged users to gain the SQL privileges of the owner of any SECURITY DEFINER function they are allowed to call.
