Lucene search

[email protected]CVE-2017-7484

HistoryMay 12, 2017 - 7:29 p.m.

CVE-2017-7484

2017-05-1219:29:00

CWE-200

CWE-285

[email protected]

web.nvd.nist.gov

173

postgresql

cve-2017-7484

information leakage

pg_statistic

privilege check

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.3 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.3%

JSON

It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access.

Affected configurations

Vulners

NVD

Node

the_postgresql_global_development_grouppostgresqlRange9.2–9.6

CPENameOperatorVersion
postgresql:postgresqlpostgresqlle9.2.20
postgresql:postgresqlpostgresqleq9.3
postgresql:postgresqlpostgresqleq9.3.1
postgresql:postgresqlpostgresqleq9.3.2
postgresql:postgresqlpostgresqleq9.3.3
postgresql:postgresqlpostgresqleq9.3.4
postgresql:postgresqlpostgresqleq9.3.5
postgresql:postgresqlpostgresqleq9.3.6
postgresql:postgresqlpostgresqleq9.3.7
postgresql:postgresqlpostgresqleq9.3.8

CPE	Name	Operator	Version
postgresql:postgresql	postgresql	le	9.2.20
postgresql:postgresql	postgresql	eq	9.3
postgresql:postgresql	postgresql	eq	9.3.1
postgresql:postgresql	postgresql	eq	9.3.2
postgresql:postgresql	postgresql	eq	9.3.3
postgresql:postgresql	postgresql	eq	9.3.4
postgresql:postgresql	postgresql	eq	9.3.5
postgresql:postgresql	postgresql	eq	9.3.6
postgresql:postgresql	postgresql	eq	9.3.7
postgresql:postgresql	postgresql	eq	9.3.8

Rows per page:

1-10 of 401

CNA Affected

[
  {
    "product": "PostgreSQL",
    "vendor": "The PostgreSQL Global Development Group",
    "versions": [
      {
        "status": "affected",
        "version": "9.2 - 9.6"
      }
    ]
  }
]