CVE-2019-10208
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2019
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
postgresql
- Vendor
- PostgreSQL
- Product
- postgresql
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| all 11.x before 11.5 | affected | Unavailable | Unavailable | Unavailable | None listed |
| all 10.x before 10.10 | affected | Unavailable | Unavailable | Unavailable | None listed |
| all 9.6.x before 9.6.15 | affected | Unavailable | Unavailable | Unavailable | None listed |
| all 9.5.x before 9.5.19 | affected | Unavailable | Unavailable | Unavailable | None listed |
| all 9.4.x before 9.4.24 | affected | Unavailable | Unavailable | Unavailable | None listed |