Vulnerability Report

CVE-2007-2138

Title: Postgresql

Other

Proof Of Concept

No public PoC currently indexed for CVE-2007-2138.

CWE Category CWE-264

Published Date Apr 24, 2007

Modified Date Jun 16, 2026

Exploit Status Not Found

Score 6.0 CVSS v2.0

Exploit Probability (EPSS)

3.69%

Vulnerability Summary

CVE-2007-2138: Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted to call a SECURITY DEFINER function, to gain the privileges of the function owner, related to "search_path settings."

Impacted Vendors

postgresql 1

anynines 1

Reference Links

http://rhn.redhat.com/errata/RHSA-2007-0336.html http://secunia.com/advisories/24989 http://secunia.com/advisories/24999 http://secunia.com/advisories/25005 http://secunia.com/advisories/25019 http://secunia.com/advisories/25037 http://secunia.com/advisories/25058 http://secunia.com/advisories/25184 http://secunia.com/advisories/25238 http://secunia.com/advisories/25334 http://secunia.com/advisories/25717 http://secunia.com/advisories/25720 http://secunia.com/advisories/25725 http://security.gentoo.org/glsa/glsa-200705-12.xml http://sunsolve.sun.com/search/document.do?assetkey=1-26-102894-1 http://support.avaya.com/elmodocs2/security/ASA-2007-190.htm http://www.debian.org/security/2007/dsa-1309 http://www.debian.org/security/2007/dsa-1311 http://www.mandriva.com/security/advisories?name=MDKSA-2007:094 http://www.postgresql.org/about/news.791 http://www.postgresql.org/support/security.html http://www.redhat.com/support/errata/RHSA-2007-0337.html http://www.securityfocus.com/bid/23618 http://www.securitytracker.com/id?1017974 http://www.trustix.org/errata/2007/0015/ http://www.ubuntu.com/usn/usn-454-1 http://www.vupen.com/english/advisories/2007/1497 http://www.vupen.com/english/advisories/2007/1549 https://exchange.xforce.ibmcloud.com/vulnerabilities/33842 https://issues.rpath.com/browse/RPL-1292 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10090 http://rhn.redhat.com/errata/RHSA-2007-0336.html http://secunia.com/advisories/24989 http://secunia.com/advisories/24999 http://secunia.com/advisories/25005 http://secunia.com/advisories/25019 http://secunia.com/advisories/25037 http://secunia.com/advisories/25058 http://secunia.com/advisories/25184 http://secunia.com/advisories/25238 http://secunia.com/advisories/25334 http://secunia.com/advisories/25717 http://secunia.com/advisories/25720 http://secunia.com/advisories/25725 http://security.gentoo.org/glsa/glsa-200705-12.xml http://sunsolve.sun.com/search/document.do?assetkey=1-26-102894-1 http://support.avaya.com/elmodocs2/security/ASA-2007-190.htm http://www.debian.org/security/2007/dsa-1309 http://www.debian.org/security/2007/dsa-1311 http://www.mandriva.com/security/advisories?name=MDKSA-2007:094 http://www.postgresql.org/about/news.791 http://www.postgresql.org/support/security.html http://www.redhat.com/support/errata/RHSA-2007-0337.html http://www.securityfocus.com/bid/23618 http://www.securitytracker.com/id?1017974 http://www.trustix.org/errata/2007/0015/ http://www.ubuntu.com/usn/usn-454-1 http://www.vupen.com/english/advisories/2007/1497 http://www.vupen.com/english/advisories/2007/1549 https://exchange.xforce.ibmcloud.com/vulnerabilities/33842 https://issues.rpath.com/browse/RPL-1292 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10090

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

6.0

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:S/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2007-2138 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

June 16, 2026 MODIFIED

Vulnerability data updated via NVD.

April 09, 2025 MODIFIED

Vulnerability data or affected products updated.

April 24, 2007 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:N/AC:M/Au:S/C:P/I:P/A:P

Affected Stack

No specific products linked.