Privilege escalation vulnerability for adapter-based row-level security

Detail name	Value
Changelog Number	11881
Type	Bug
Status	Resolved
Affected Versions	Exasol 6.2.0
Fix Versions	Exasol 6.2.15
Resolution Date	2021-06-07

Vulnerability

Classification: Medium

We identified a privilege escalation vulnerability with adapter-based row-level security plugins that rely on extending filter conditions (e.g. https://github.com/exasol/row-level-security). An attacker can circumvent any rule that is defined to limit the number of visible rows.

This only affects Exasol version 6.2. Later versions, e.g. 7.0, are not affected.

Remediation

Exasol 6.2 users that use such row-level security plugins should upgrade to Exasol version 6.2.15.