CVE-2024-10978

Summary

CVE-2024-10978 is a vulnerability in PostgreSQL that stems from incorrect privilege assignment. This issue allows a less-privileged application user to access or modify data intended for other users. The flaw is exploited when an application employs SET ROLE, SET SESSION AUTHORIZATION, or equivalent functions, and uses parameters from an attacker or shares query results. If the query responds to current_setting('role') or the current user ID, it may erroneously grant data access. The flaw affects PostgreSQL versions below 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.