CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 6.0
CWE Name:  Permissions Privileges and Access Controls
Summary: the pl/tcl implementation in postgresql 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 beta before 9.0 beta 2 loads tcl code from the pltcl_modules table regardless of the table's ownership and permissions, which allows remote authenticated users, with database-creation privileges, to execute arbitrary tcl code by creating this table and inserting a crafted tcl script.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2010-05-19
Last Modified Date: 2017-09-19