Riskcovery

CVE-2025-46801

State
Published
Severity
9.3 Critical
Published
May 19, 2025
Updated
Nov 3, 2025
Reserved
Apr 30, 2025

Read the record on cve.org

Description

Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or disable the database.

Scores

CVSSScoreVectorSource
4.09.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Njpcert
3.09.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hjpcert

Weaknesses

  • CWE-305 Authentication bypass by primary weakness

Affected Products

ProductVersions
Pgpool-IIPgPool Global Development Group
  • 4.6.0Affected
Pgpool-IIPgPool Global Development Group
  • 4.5.0 to 4.5.6Affected
Pgpool-IIPgPool Global Development Group
  • 4.4.0 to 4.4.11Affected
Pgpool-IIPgPool Global Development Group
  • 4.3.0 to 4.3.14Affected
Pgpool-IIPgPool Global Development Group
  • 4.2.0 to 4.2.21Affected
Pgpool-IIPgPool Global Development Group
  • All versions of 4.1 seriesAffected
Pgpool-IIPgPool Global Development Group
  • All versions of 4.0 seriesAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.