CVE-2010-3781

2010-10-0621:00:01

CWE-264

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

AI Score

Confidence

Low

EPSS

0.04

Percentile

92.1%

JSON

The PL/php add-on 1.4 and earlier for PostgreSQL does not properly protect script execution by a different SQL user identity within the same session, which allows remote authenticated users to gain privileges via crafted script code in a SECURITY DEFINER function, a related issue to CVE-2010-3433.

Affected configurations

Nvd

Node

alvaro_herrerapl\/phpRange≤1.4

alvaro_herrerapl\/phpMatch1.0

alvaro_herrerapl\/phpMatch1.1

alvaro_herrerapl\/phpMatch1.2

alvaro_herrerapl\/phpMatch1.3.1

alvaro_herrerapl\/phpMatch1.3.2

alvaro_herrerapl\/phpMatch1.3.3

alvaro_herrerapl\/phpMatch1.3.5beta1

AND

postgresqlpostgresql

VendorProductVersionCPE
alvaro_herrerapl\/php*cpe:2.3:a:alvaro_herrera:pl\/php:*:*:*:*:*:*:*:*
alvaro_herrerapl\/php1.0cpe:2.3:a:alvaro_herrera:pl\/php:1.0:*:*:*:*:*:*:*
alvaro_herrerapl\/php1.1cpe:2.3:a:alvaro_herrera:pl\/php:1.1:*:*:*:*:*:*:*
alvaro_herrerapl\/php1.2cpe:2.3:a:alvaro_herrera:pl\/php:1.2:*:*:*:*:*:*:*
alvaro_herrerapl\/php1.3.1cpe:2.3:a:alvaro_herrera:pl\/php:1.3.1:*:*:*:*:*:*:*
alvaro_herrerapl\/php1.3.2cpe:2.3:a:alvaro_herrera:pl\/php:1.3.2:*:*:*:*:*:*:*
alvaro_herrerapl\/php1.3.3cpe:2.3:a:alvaro_herrera:pl\/php:1.3.3:*:*:*:*:*:*:*
alvaro_herrerapl\/php1.3.5cpe:2.3:a:alvaro_herrera:pl\/php:1.3.5:beta1:*:*:*:*:*:*
postgresqlpostgresql*cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
alvaro_herrera	pl\/php	*	cpe:2.3:a:alvaro_herrera:pl\/php::::::::
alvaro_herrera	pl\/php	1.0	cpe:2.3:a:alvaro_herrera:pl\/php:1.0:::::::*
alvaro_herrera	pl\/php	1.1	cpe:2.3:a:alvaro_herrera:pl\/php:1.1:::::::*
alvaro_herrera	pl\/php	1.2	cpe:2.3:a:alvaro_herrera:pl\/php:1.2:::::::*
alvaro_herrera	pl\/php	1.3.1	cpe:2.3:a:alvaro_herrera:pl\/php:1.3.1:::::::*
alvaro_herrera	pl\/php	1.3.2	cpe:2.3:a:alvaro_herrera:pl\/php:1.3.2:::::::*
alvaro_herrera	pl\/php	1.3.3	cpe:2.3:a:alvaro_herrera:pl\/php:1.3.3:::::::*
alvaro_herrera	pl\/php	1.3.5	cpe:2.3:a:alvaro_herrera:pl\/php:1.3.5:beta1::::::
postgresql	postgresql	*	cpe:2.3:a:postgresql:postgresql::::::::