CVE-2024-49042

Summary

CVE-2024-49042 is an elevation of privilege vulnerability affecting Azure Database for PostgreSQL Flexible Servers. This issue allows unauthenticated attackers to execute arbitrary SQL statements as the db_datareader fixed server role, which can result in unauthorized access to sensitive data or unintended database modifications. The vulnerability exists due to a misconfiguration in the extension and can be exploited through specially crafted requests to the extension endpoint. Microsoft has released a patch to mitigate the risk of this vulnerability, and it is strongly recommended that users apply the update as soon as possible to protect their databases.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.