Information Exposure Affecting pghero package, versions >=0.1.1, <3.1.0
Threat Intelligence
EPSS
0.21% (59th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-PGHERO-3225080
- published 5 Jan 2023
- disclosed 5 Jan 2023
- credit Seryun Ham
Introduced: 5 Jan 2023
CVE-2023-22626 Open this link in a new tabHow to fix?
Upgrade pghero to version 3.1.0 or higher.
Overview
pghero is a performance dashboard for Postgres.
Affected versions of this package are vulnerable to Information Exposure via the explain functionality, due to improper validation of the user query, which might result in data leakage from the query error message.
References
CVSS Scores
version 3.1