CVE-2020-13692: XEE
A flaw was found in PostgreSQL JDBC in versions prior to 42.2.13. An XML External Entity (XXE) weakness was found in PostgreSQL JDBC. The highest threat from this vulnerability is to data confidentiality and system availability.
Other sources
PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
PostgreSQL JDBC Driver could allow a remote authenticated attacker to obtain sensitive information, caused by an XML external entity (XXE) error when processing XML data. By sending specially crafted XML data, a remote attacker could exploit this vulnerability to obtain sensitive information.
— IBM
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-13692?
CVE-2020-13692 is a vulnerability in the PostgreSQL JDBC Driver.
How does CVE-2020-13692 affect PostgreSQL JDBC Driver?
CVE-2020-13692 allows a remote attacker to obtain sensitive information by exploiting an XML external entity (XXE) error in the driver.
What is the severity of CVE-2020-13692?
CVE-2020-13692 has a severity value of 7.7, which is classified as high severity.
Which versions of PostgreSQL JDBC Driver are affected by CVE-2020-13692?
PostgreSQL JDBC Driver versions before 42.2.13 are affected by CVE-2020-13692.
How can I fix CVE-2020-13692?
To fix CVE-2020-13692, you should update your PostgreSQL JDBC Driver to version 42.2.13 or higher.