Babelfish For Postgresql
Monthly
Privilege escalation in the Babelfish for PostgreSQL extension (versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8 and 5.1-5.4) allows remote authenticated users holding only a low-privileged database login to raise their own privileges, with high confidentiality, integrity and availability impact once successful. No user interaction or race condition is required - the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - but the attacker must already possess a valid login to a reachable instance, so internet-exposed deployments with shared or loosely managed accounts carry the most risk. There is no public exploit identified at time of analysis and no CISA KEV listing; the vendor states there is no workaround, so only upgrading to 4.10, 5.6 or 6.1 closes the gap.
Privilege escalation in the Babelfish for PostgreSQL extension (versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8 and 5.1-5.4) allows remote authenticated users holding only a low-privileged database login to raise their own privileges, with high confidentiality, integrity and availability impact once successful. No user interaction or race condition is required - the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - but the attacker must already possess a valid login to a reachable instance, so internet-exposed deployments with shared or loosely managed accounts carry the most risk. There is no public exploit identified at time of analysis and no CISA KEV listing; the vendor states there is no workaround, so only upgrading to 4.10, 5.6 or 6.1 closes the gap.