CVE-2022-21724 - Remote Code Execution (RCE)

Abstract

pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties.

The Oxygen Content Fusion product incorporates shelljs as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

Mitigation

None

Detail

CVE-2022-21724

Severity: Critical

CVSS Score: 9.8

The postgresql package used by Oxygen Content Fusion product is an affected version mentioned in CVE-2022-21724 vulnerability description. However, the configuration files cannot be changed by untrusted users. For that reason, we have rated the severity level for our products as low.