What is GHSA-vf99-xw26-86g5?

GHSA-vf99-xw26-86g5 is a security advisory published by GitHub Security Advisories with High severity. PgHero Allows Information Disclosure Through EXPLAIN Feature

Which CVE IDs does GHSA-vf99-xw26-86g5 cover?

GHSA-vf99-xw26-86g5 covers the following CVE IDs: CVE-2023-22626. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vf99-xw26-86g5?

GHSA-vf99-xw26-86g5 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-vf99-xw26-86g5?

GHSA-vf99-xw26-86g5 affects 1 product, including: rubygems/pghero:\u003c 3.1.0.

GHSA-vf99-xw26-86g5HighCVSS 7.5

PgHero Allows Information Disclosure Through EXPLAIN Feature

Vendor

GitHub Security Advisories

Published

January 5, 2023

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2023-22626 →

📋 Description

PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on database user privileges, this may only be information from the database, or may be information from file contents on the database server.)

🎯 Affected products1

rubygems/pghero:< 3.1.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-22626
https://github.com/ankane/pghero/issues/439
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pghero/CVE-2023-22626.yml
https://github.com/advisories/GHSA-vf99-xw26-86g5