PostgreSQL Vulnerable to Privileged Execution of Arbitrary SQL due to Late Privilege Drop in 'REFRESH MATERIALIZED VIEW CONCURRENTLY'

🗓️ 13 Feb 2025 00:00:00Reported by Broadcom Security ResponseType

Authenticated attacker with a materialized view can run SQL on concurrent refresh, risking full compromise if the victim is a superuser.

Reporter	Title	Published	Views	Family All 343
FreeBSD	postgresql-server -- non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL	8 Feb 202400:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	26 Mar 202504:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana (OnPrem) is affected by multiple security vulnerabilities	10 Jul 202407:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by a PostgreSQL vulnerability (CVE-2024-0985)	15 Jul 202419:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to security bypass due to PostgreSQL (CVE-2024-0985)	6 May 202404:19	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Commons Compress and PostgreSQL might affect IBM Storage Copy Data Management	30 Apr 202421:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities Affected for EDB	21 Jul 202513:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to security restrictions bypass in PostgreSQL [CVE-2024-0985]	25 Apr 202418:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities Affected for EDB	21 Jul 202513:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple PostgreSQL Vulnerabilities Affect IBM Storage Scale System	21 Jun 202415:45	–	ibm

Vulners

Node

13 Feb 2025 22:20Current

7.7High risk

Vulners AI Score7.7

CVSS 3.18

EPSS0.01465

SSVC