CVE-2020-1720

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-285 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Mar 17, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-17216.1A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID du CVE-2020-17225.3A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the pas CVE-2020-17236.1A flaw was found in Keycloak Gatekeeper (Louketo). The logout endpoint can be abused to redirect logged-in users to arbitrary web pages. Aff CVE-2020-17244.3A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal in CVE-2020-17255.4A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings CVE-2020-17265.9A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are CVE-2020-17275.4A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation CVE-2020-17285.4A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing g CVE-2020-17294.4A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially CVE-2020-17305.3A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The ser CVE-2020-17319.8A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin CVE-2020-17324.2A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across