CVE-2019-10128

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-03-19 · updated 2026-06-17
Weakness: CWE-284

Description

A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, this allows a local attacker to read arbitrary data directory files, essentially bypassing database-imposed read access limitations. In plausible non-default configurations, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code.

Affected products

PostgreSQL: before 9.4.22; from 9.5.0 before 9.5.17; from 9.6.0 before 9.6.13; from 10.0 before 10.8; from 11.0 before 11.3 — fixed in 10.8, 11.3, 9.4.22, 9.5.17, 9.6.13

How to fix

Upgrade to a fixed version: PostgreSQL 10.8, 11.3, 9.4.22, 9.5.17. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-10128 or the next vulnerability affects your stack