[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQT3chbm7JugXtZgVCAbjXMiQzmijz4GHMpV09wUO_uQ":3,"g5a-risk:CVE-2022-26520":139},{"success":4,"data":5,"meta":137},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":39,"epssPercentile":27,"epssTimeSeries":40,"severity":41,"affectedProducts":42,"affectedProductsCount":56,"references":57,"referencesCount":80,"weaknesses":81,"weaknessesCount":85,"isActivelyExploited":86,"cisaInfo":27,"otxData":27,"relatedBlogPosts":87,"seoMetadata":88,"configurations":113,"relatedVendorCves":135,"notableEvents":136},"CVE-2022-26520","What is CVE-2022-26520?","In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties","In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the...","2022-03-10T17:47:45.81","2024-08-03T05:16:23.903",9.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":27,"CVSSMetricV2":30,"CVSSMetricV40":27},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":28,"ImpactScore":29},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":25,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"TemporalSeverity":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":25,"ModifiedAttackVector":27,"ModifiedAttackComplexity":27,"ModifiedPrivilegesRequired":27,"ModifiedUserInteraction":27,"ModifiedScope":27,"ModifiedConfidentialityImpact":27,"ModifiedIntegrityImpact":27,"ModifiedAvailabilityImpact":27,"EnvironmentalScore":27,"EnvironmentalSeverity":27},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH","CRITICAL",null,3.9,5.9,[31],{"Source":17,"Type":18,"CVSSData":32,"BaseSeverity":25,"ExploitabilityScore":37,"ImpactScore":38,"ACInsufInfo":27,"ObtainAllPrivilege":27,"ObtainUserPrivilege":27,"ObtainOtherPrivilege":27,"UserInteractionRequired":27},{"Version":33,"VectorString":34,"AccessVector":21,"AccessComplexity":22,"Authentication":23,"ConfidentialityImpact":35,"IntegrityImpact":35,"AvailabilityImpact":35,"BaseScore":36,"BaseSeverity":27,"Exploitability":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"CollateralDamagePotential":27,"TargetDistribution":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":27,"EnvironmentalScore":27},"2.0","AV:N\u002FAC:L\u002FAu:N\u002FC:P\u002FI:P\u002FA:P","PARTIAL",7.5,10,6.4,0.02999,[39,39,39,39,39,39,39],"Critical",[43,48,53],{"vendor":44,"product":45,"version":46,"criteria":47,"vulnerable":4},"postgresql","postgresql_jdbc_driver","*","cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:*",{"vendor":49,"product":50,"version":51,"criteria":52,"vulnerable":4},"debian","debian_linux","10.0","cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",{"vendor":49,"product":50,"version":54,"criteria":55,"vulnerable":4},"11.0","cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",3,[58,64,67,73,76],{"url":59,"source":60,"tags":61},"https:\u002F\u002Fgithub.com\u002Fpgjdbc\u002Fpgjdbc\u002Fpull\u002F2454\u002Fcommits\u002F017b929977b4f85795f9ad2fa5de6e80978b8ccc","GitHub",[62,63],"Patch","Third Party Advisory",{"url":65,"source":60,"tags":66},"https:\u002F\u002Fgithub.com\u002Fpgjdbc\u002Fpgjdbc\u002Fsecurity\u002Fadvisories\u002FGHSA-673j-qm5f-xpv8",[63],{"url":68,"source":69,"tags":70},"https:\u002F\u002Fjdbc.postgresql.org\u002Fdocumentation\u002Fchangelog.html#version_42.3.3","Postgresql",[71,72],"Release Notes","Vendor Advisory",{"url":74,"source":69,"tags":75},"https:\u002F\u002Fjdbc.postgresql.org\u002Fdocumentation\u002Fhead\u002Ftomcat.html",[72],{"url":77,"source":78,"tags":79},"https:\u002F\u002Fwww.debian.org\u002Fsecurity\u002F2022\u002Fdsa-5196","Debian",[63],5,[82],{"id":83,"name":83,"description":84},"Unknown","NVD-CWE-noinfo",1,false,[],{"title":89,"metaDescription":90,"keywords":91,"canonicalUrl":92,"structuredData":93},"What is CVE-2022-26520? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2022-26520, a critical severity cyber security vulnerability from 2022. In pgjdbc before 42.3.3, an attacker (who controls the ...","CVE-2022-26520, CVE-2022-26520 vulnerability, CVE-2022-26520 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2022, CVSS score, exploit, patch, remediation, postgresql security, debian security, postgresql_jdbc_driver vulnerability, debian_linux vulnerability","\u002Fwhat-is\u002Fcve-2022-26520",{"@context":94,"@type":95,"headline":89,"description":90,"datePublished":10,"dateModified":11,"author":96,"publisher":100,"about":104,"mainEntityOfPage":108,"articleSection":111,"keywords":112},"https:\u002F\u002Fschema.org","TechArticle",{"@type":97,"name":98,"url":99},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":97,"name":98,"url":99,"logo":101},{"@type":102,"url":103},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":105,"name":6,"description":106,"additionalType":107},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":109,"@id":110},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2022-26520","Cybersecurity","CVE-2022-26520, CVE-2022-26520 vulnerability, CVE-2022-26520 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[114,127],{"Operator":27,"Negate":27,"Nodes":115},[116],{"Operator":117,"Negate":27,"CPEMatch":118},"OR",[119,123],{"Vulnerable":4,"Criteria":47,"MatchCriteriaID":120,"VersionStartExcluding":27,"VersionStartIncluding":121,"VersionEndExcluding":27,"VersionEndIncluding":122},"E992D2E1-C637-4046-8077-18D8C2FF1433","42.1.0","42.1.4",{"Vulnerable":4,"Criteria":47,"MatchCriteriaID":124,"VersionStartExcluding":27,"VersionStartIncluding":125,"VersionEndExcluding":126,"VersionEndIncluding":27},"FB084209-C713-42F1-B1C4-78C92AA63720","42.3.0","42.3.3",{"Operator":27,"Negate":27,"Nodes":128},[129],{"Operator":117,"Negate":27,"CPEMatch":130},[131,133],{"Vulnerable":4,"Criteria":52,"MatchCriteriaID":132,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",{"Vulnerable":4,"Criteria":55,"MatchCriteriaID":134,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":27,"VersionEndIncluding":27},"FA6FEEC2-9F11-4643-8827-749718254FED",[],[],{"lastModified":11,"cacheTime":138,"version":33},1792361998703,{"score":140,"band":141,"action":142,"scoredAt":143},54,"Medium","Plan remediation","2026-10-16T06:53:48.838834+00:00"]