{"id":"CVE-2025-46801","state":"PUBLISHED","title":"Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be abl","description":"Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or disable the database.","publishedAt":"2025-05-19T07:14:45.304Z","updatedAt":"2025-11-03T17:44:50.344Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"jpcert"},"assigner":"jpcert","products":["PgPool Global Development Group Pgpool-II"],"affected":[{"vendor":"PgPool Global Development Group","product":"Pgpool-II","versions":[{"version":"4.6.0","status":"affected"}]},{"vendor":"PgPool Global Development Group","product":"Pgpool-II","versions":[{"version":"4.5.0 to 4.5.6","status":"affected"}]},{"vendor":"PgPool Global Development Group","product":"Pgpool-II","versions":[{"version":"4.4.0 to 4.4.11","status":"affected"}]},{"vendor":"PgPool Global Development Group","product":"Pgpool-II","versions":[{"version":"4.3.0 to 4.3.14","status":"affected"}]},{"vendor":"PgPool Global Development Group","product":"Pgpool-II","versions":[{"version":"4.2.0 to 4.2.21","status":"affected"}]},{"vendor":"PgPool Global Development Group","product":"Pgpool-II","versions":[{"version":"All versions of 4.1 series","status":"affected"}]},{"vendor":"PgPool Global Development Group","product":"Pgpool-II","versions":[{"version":"All versions of 4.0 series","status":"affected"}]}],"references":["https://www.pgpool.net/mediawiki/index.php/Main_Page#News","https://jvn.jp/en/jp/JVN06238225/","https://lists.debian.org/debian-lts-announce/2025/10/msg00014.html"],"weaknesses":["CWE-305"],"ingestedAt":"2026-10-29T20:09:17.366Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/46xxx/CVE-2025-46801.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-46801","state":"PUBLISHED","datePublished":"2025-05-19T07:14:45.304Z","dateUpdated":"2025-11-03T17:44:50.344Z","assignerShortName":"jpcert","assignerOrgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateReserved":"2025-04-30T08:26:53.970Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or disable the database."}],"affected":[{"vendor":"PgPool Global Development Group","product":"Pgpool-II","versions":[{"version":"4.6.0","status":"affected"}]},{"vendor":"PgPool Global Development Group","product":"Pgpool-II","versions":[{"version":"4.5.0 to 4.5.6","status":"affected"}]},{"vendor":"PgPool Global Development Group","product":"Pgpool-II","versions":[{"version":"4.4.0 to 4.4.11","status":"affected"}]},{"vendor":"PgPool Global Development Group","product":"Pgpool-II","versions":[{"version":"4.3.0 to 4.3.14","status":"affected"}]},{"vendor":"PgPool Global Development Group","product":"Pgpool-II","versions":[{"version":"4.2.0 to 4.2.21","status":"affected"}]},{"vendor":"PgPool Global Development Group","product":"Pgpool-II","versions":[{"version":"All versions of 4.1 series","status":"affected"}]},{"vendor":"PgPool Global Development Group","product":"Pgpool-II","versions":[{"version":"All versions of 4.0 series","status":"affected"}]}],"references":[{"url":"https://www.pgpool.net/mediawiki/index.php/Main_Page#News"},{"url":"https://jvn.jp/en/jp/JVN06238225/"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_0":{"version":"3.0","baseSeverity":"CRITICAL","baseScore":9.8,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}},{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV4_0":{"version":"4.0","baseSeverity":"CRITICAL","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-305","description":"Authentication bypass by primary weakness","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"jpcert","orgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","dateUpdated":"2025-05-19T07:14:45.304Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-19T16:02:35.673653Z","id":"CVE-2025-46801","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-19T16:02:56.831Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00014.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T17:44:50.344Z"}}]}}}