vulnwire
6.5med

CVE-2017-15099

INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table conten…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
6.3%
percentile 94%
Public exploits
0
none known

INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.

Exploit prediction (EPSS)

6.32% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD2.04.0AV:N/AC:L/Au:S/C:P/I:N/A:N

Affected products

  • Red Hat, Inc. postgresql

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Technology feeds
PostgreSQL (RSS, critical only)

References

  • securityfocus.com /bid/101781 · vdb-entry, x_refsource_BID, x_transferred
  • access.redhat.com /errata/RHSA-2018:2511 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • postgresql.org /support/security/ · x_refsource_MISC, x_transferred
  • securitytracker.com /id/1039752 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • postgresql.org /about/news/1801/ · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2018:2566 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • debian.org /security/2017/dsa-4028 · vendor-advisory, x_refsource_DEBIAN, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.