CVE-2018-10925highCWE-863

CVE-2018-10925: high-severity vulnerability in postgresql

Published · Updated

Follow this CVE+ Monitor PostgreSQL+ Monitor postgresql15

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 2.2%
It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involved with "INSERT ... ON CONFLICT DO UPDATE". An attacker with "CREATE TABLE" privileges could exploit this to read arbitrary bytes server memory. If the attacker also had certain "INSERT" and limited "UPDATE" privileges to a particular table, they could exploit this to update other columns in the same table.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected products
PostgreSQL Global Development Group · postgresql
Related CVEs — postgresql

In the same product, most dangerous first.

CVE-2018-10915HIGHCVE-2018-10915EPSS 5.1%