Anonymizer
Monthly
Privilege escalation in PostgreSQL Anonymizer before 3.1.0 allows an authenticated database user with CREATE TABLE rights to embed SQL in a column identifier, which then runs with superuser privileges when a superuser calls the k-anonymity function on the malicious table. PostgreSQL 14 and instances upgraded from PostgreSQL 14 or earlier are most exposed because ordinary users can create tables in the public schema by default, while PostgreSQL 15 and later require an explicit CREATE TABLE grant. Signals diverge sharply: CVSS is 8.8 with total technical impact, but EPSS is 0.04% (12th percentile), SSVC exploitation is none, and no public exploit or CISA KEV entry was identified at time of analysis.
PostgreSQL Anonymizer v1.2 contains a vulnerability that allows a user who owns a table to elevate to superuser. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
PostgreSQL Anonymizer v1.2 contains a SQL injection vulnerability that allows a user who owns a table to elevate to superuser when dynamic masking is enabled. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable.
Privilege escalation in PostgreSQL Anonymizer before 3.1.0 allows an authenticated database user with CREATE TABLE rights to embed SQL in a column identifier, which then runs with superuser privileges when a superuser calls the k-anonymity function on the malicious table. PostgreSQL 14 and instances upgraded from PostgreSQL 14 or earlier are most exposed because ordinary users can create tables in the public schema by default, while PostgreSQL 15 and later require an explicit CREATE TABLE grant. Signals diverge sharply: CVSS is 8.8 with total technical impact, but EPSS is 0.04% (12th percentile), SSVC exploitation is none, and no public exploit or CISA KEV entry was identified at time of analysis.
PostgreSQL Anonymizer v1.2 contains a vulnerability that allows a user who owns a table to elevate to superuser. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
PostgreSQL Anonymizer v1.2 contains a SQL injection vulnerability that allows a user who owns a table to elevate to superuser when dynamic masking is enabled. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable.