4.3

CVE-2019-10130: opensuse leap Improper Access Control

CVSS: 4.3v3.1MediumModified
AliasesALPINE-CVE-2019-10130SUSE-SU-2019:1511-1SUSE-SU-2019:1687-1
Published 30-07-2019Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2019-10130 is a medium (CVSS 4.3) Improper Access Control vulnerability in opensuse leap. EPSS estimates a 1.08% chance of exploitation in the next 30 days, higher than 64.6% of scored vulnerabilities.

Overall risk
17/100
0100
Low · default modelHow is this calculated?
CVSS score
4.3/10
010
Medium · v3.1 (NVD)
EPSS score
1.08%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 16 · Related 6
MGASA-2019-0189OPENSUSE-SU-2019:1773-1OPENSUSE-SU-2020:1227-1OPENSUSE-SU-2024:11184-1OPENSUSE-SU-2024:11185-1RHSA-2020:0980

Timeline

  1. 30-07-2019
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17. PostgreSQL maintains column statistics for tables. Certain statistics, such as histograms and lists of most common values, contain values taken from the column. PostgreSQL does not evaluate row security policies before consulting those statistics during query planning; an attacker can exploit this to read the most common values of certain columns. Affected columns are those for which the attacker has SELECT privilege and for which, in an ordinary query, row-level security prunes the set of rows visible to the attacker.

CVSS metrics

7 scores · 4 sources · 3 versions

EPSS trend

Probability

1.08%

Chance of exploitation in the next 30 days

Percentile

65%

Versus all other CVEs

30-day change

0.00 pp

From 1.08% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.08%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse21 products
  • postgresql10-libs&distro=SUSE Linux Enterprise Desktop 12 SP3< 10.8-1.9.1
  • postgresql10-libs&distro=SUSE Linux Enterprise Desktop 12 SP4< 10.8-1.9.1
  • postgresql10-libs&distro=SUSE Linux Enterprise Server 12 SP3< 10.8-1.9.1
  • postgresql10-libs&distro=SUSE Linux Enterprise Server 12 SP4< 10.8-1.9.1
  • postgresql10-libs&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3< 10.8-1.9.1
Alpine3 products
  • postgresql≥ 9.5.0, < 11.3-r0 | ≥ 9.5.0, < 9.6.13-r0 | ≥ 9.5.0, < 10.8-r0
  • postgresql14< 11.3-r0
  • postgresql15< 11.3-r0
Ubuntu2 products
  • postgresql-10< 10.8-0ubuntu0.18.04.1
  • postgresql-9.5< 9.5.17-0ubuntu0.16.04.1
Debian1 product
  • postgresql-9.6< 9.6.13-0+deb9u1
Opensuse1 product
Postgresql1 product
  • postgresql≥ 9.5.0, < 9.5.17 | ≥ 9.6.0, < 9.6.13 | ≥ 10.0, < 10.8 | ≥ 11.0, < 11.3
Postgresql project1 product
  • postgresql11.x up to, excluding 11.3 | 10.x up to, excluding 10.8 | 9.6.x up to, excluding 9.6.13 | 9.5.x up to, excluding 9.5.17

7 vendors · 30 products

References

13 links
Show all 13 references