CVE-2017-7486

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-05-12 · updated 2026-06-17
Weakness: CWE-522

Description

PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.

Affected products

PostgreSQL: 8.4, 8.4.1, 8.4.2, 8.4.3, 8.4.4, 8.4.5 (+128)

References

http://www.debian.org/security/2017/dsa-3851
http://www.securityfocus.com/bid/98460
http://www.securitytracker.com/id/1038476
https://access.redhat.com/errata/RHSA-2017:1677
https://access.redhat.com/errata/RHSA-2017:1678
https://access.redhat.com/errata/RHSA-2017:1838
https://access.redhat.com/errata/RHSA-2017:1983
https://access.redhat.com/errata/RHSA-2017:2425
https://security.gentoo.org/glsa/201710-06
https://www.postgresql.org/about/news/1746/
http://www.debian.org/security/2017/dsa-3851
http://www.securityfocus.com/bid/98460

Get alerted when CVE-2017-7486 or the next vulnerability affects your stack