CVE-2025-8715

{"id": "CVE-2025-8715", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-08-14T13:15:37.880", "references": [{"url": "https://www.postgresql.org/support/security/CVE-2025-8715/", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "description": [{"lang": "en", "value": "CWE-93"}]}], "descriptions": [{"lang": "en", "value": "Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it."}, {"lang": "es", "value": "La neutralizaci\u00f3n incorrecta de saltos de l\u00ednea en pg_dump en PostgreSQL permite a un usuario del servidor de origen inyectar c\u00f3digo arbitrario para su ejecuci\u00f3n en tiempo de restauraci\u00f3n como la cuenta del sistema operativo cliente que ejecuta psql para restaurar el volcado, mediante metacomandos psql dentro de un nombre de objeto espec\u00edficamente manipulado. Los mismos ataques pueden lograr la inyecci\u00f3n SQL como superusuario del servidor de destino de la restauraci\u00f3n. pg_dumpall, pg_restore y pg_upgrade tambi\u00e9n se ven afectados. Las versiones anteriores a PostgreSQL 17.6, 16.10, 15.14, 14.19 y 13.22 est\u00e1n afectadas. Las versiones anteriores a la 11.20 no se ven afectadas. CVE-2012-0868 hab\u00eda corregido este tipo de problema, pero la versi\u00f3n 11.20 lo reintrodujo."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}