CVE Vulnerabilities

CVE-2019-10210

Insufficiently Protected Credentials

Published: Oct 29, 2019 | Modified: Nov 07, 2022
CVSS 3.x
7
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
1.9 LOW
AV:L/AC:M/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
6.7 MODERATE
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Ubuntu

Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file.

Weakness

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Affected Software

Name Vendor Start Version End Version
Postgresql Postgresql * 9.4.24 (excluding)
Postgresql Postgresql 9.5.0 (including) 9.5.19 (excluding)
Postgresql Postgresql 9.6.0 (including) 9.6.15 (excluding)
Postgresql Postgresql 10.0 (including) 10.10 (excluding)
Postgresql Postgresql 11.0 (including) 11.5 (excluding)

Potential Mitigations

References