CVE-2012-3489 describes an XML External Entity (XXE) vulnerability in the xml_parse function within the libxml2 support of PostgreSQL versions 8.3, 8.4, 9.0, and 9.1, as well as products from Apple, Canonical, Debian, openSUSE, and Red Hat. This flaw allows remote authenticated users to determine the existence of arbitrary files or URLs, and potentially access their content, by submitting crafted XML values. With a CVSS score of 6.5 (Medium), the vulnerability has a network attack vector and low attack complexity, posing a high risk to confidentiality. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in CISA's KEV catalog; however, it has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.3.0, < 8.3.20CPE matchmatch criteria | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* | ||
>= 8.4.0, < 8.4.13CPE matchmatch criteria | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* | ||
>= 9.0.0, < 9.0.9CPE matchmatch criteria | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* | ||
>= 9.1.0, < 9.1.5CPE matchmatch criteria | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* | ||
11.4CPE matchmatch criteria | cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.