CVE-2017-7484

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-05-12 · updated 2026-06-17
Weakness: CWE-285

Description

It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access.

Affected products

PostgreSQL: through 9.2.20; 9.3, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.3.5 (+33)

References

http://www.debian.org/security/2017/dsa-3851
http://www.securityfocus.com/bid/98459
http://www.securitytracker.com/id/1038476
https://access.redhat.com/errata/RHSA-2017:1677
https://access.redhat.com/errata/RHSA-2017:1678
https://access.redhat.com/errata/RHSA-2017:1838
https://access.redhat.com/errata/RHSA-2017:1983
https://access.redhat.com/errata/RHSA-2017:2425
https://security.gentoo.org/glsa/201710-06
https://www.postgresql.org/about/news/1746/
http://www.debian.org/security/2017/dsa-3851
http://www.securityfocus.com/bid/98459

Get alerted when CVE-2017-7484 or the next vulnerability affects your stack