CVE-2019-10128.json

{
    "CVE-ID": "CVE-2019-10128",
    "NVD": {
        "Descriptions": "A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, this allows a local attacker to read arbitrary data directory files, essentially bypassing database-imposed read access limitations. In plausible non-default configurations, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code.",
        "Cvss2_BaseScore": 4.1,
        "Cvss3_BaseScore": 7.8,
        "Cvss2_VectorString": "AV:L/AC:M/Au:S/C:P/I:P/A:P",
        "Cvss3_VectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
        "CPEs": [
            {
                "URI": "cpe:/a:postgresql:postgresql",
                "FormattedString": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "",
                "VersionEndExcluding": "9.4.22",
                "VersionEndIncluding": ""
            },
            {
                "URI": "cpe:/a:postgresql:postgresql",
                "FormattedString": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "10.0",
                "VersionEndExcluding": "10.8",
                "VersionEndIncluding": ""
            },
            {
                "URI": "cpe:/a:postgresql:postgresql",
                "FormattedString": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "11.0",
                "VersionEndExcluding": "11.3",
                "VersionEndIncluding": ""
            },
            {
                "URI": "cpe:/a:postgresql:postgresql",
                "FormattedString": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "9.5.0",
                "VersionEndExcluding": "9.5.17",
                "VersionEndIncluding": ""
            },
            {
                "URI": "cpe:/a:postgresql:postgresql",
                "FormattedString": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
                "VersionStartExcluding": "",
                "VersionStartIncluding": "9.6.0",
                "VersionEndExcluding": "9.6.13",
                "VersionEndIncluding": ""
            }
        ]
    },
    "Official": {
        "9.4.22": {
            "source": [
                "https://www.postgresql.org/support/security/9.4/"
            ]
        },
        "9.5.17": {
            "source": [
                "https://www.postgresql.org/support/security/9.5/"
            ]
        },
        "9.6.13": {
            "source": [
                "https://www.postgresql.org/support/security/9.6/"
            ]
        },
        "10.8": {
            "source": [
                "https://www.postgresql.org/support/security/10/"
            ]
        },
        "11.3": {
            "source": [
                "https://www.postgresql.org/support/security/11/"
            ]
        }
    }
}