CVE-2016-2193 Auth bypass in n/a
Attackers can bypass row-security access restrictions in PostgreSQL by exploiting cached plans in multi-role sessions, potentially reading unauthorized data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-2193?
CVE-2016-2193 is a high-severity authentication bypass vulnerability in Postgresql Postgresql, published on 11 Apr 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached plans, which might allow attackers to bypass intended access restrictions by leveraging a session that performs queries as more than one role.
Weakness: CWE-254
Which versions are affected by CVE-2016-2193?
It affects 1 product.
Products include Postgresql Postgresql.
How do I fix CVE-2016-2193?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-2193 being exploited?
There is no known exploitation of CVE-2016-2193 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as GHSA-v26h-59p8-6x7c.