CVE-2017-7484
Estado: ModificadaAlta (7.5)—
It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.56%
- Percentil entre todas las CVEs puntuadas: 85
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-285
- CWE-200
Referencias
- http://www.debian.org/security/2017/dsa-3851
- http://www.securityfocus.com/bid/98459
- http://www.securitytracker.com/id/1038476
- https://access.redhat.com/errata/RHSA-2017:1677
- https://access.redhat.com/errata/RHSA-2017:1678
- https://access.redhat.com/errata/RHSA-2017:1838
- https://access.redhat.com/errata/RHSA-2017:1983
- https://access.redhat.com/errata/RHSA-2017:2425
- https://security.gentoo.org/glsa/201710-06
- https://www.postgresql.org/about/news/1746/
- http://www.debian.org/security/2017/dsa-3851
- http://www.securityfocus.com/bid/98459
- http://www.securitytracker.com/id/1038476
- https://access.redhat.com/errata/RHSA-2017:1677
- https://access.redhat.com/errata/RHSA-2017:1678
- https://access.redhat.com/errata/RHSA-2017:1838
- https://access.redhat.com/errata/RHSA-2017:1983
- https://access.redhat.com/errata/RHSA-2017:2425
- https://security.gentoo.org/glsa/201710-06
- https://www.postgresql.org/about/news/1746/
JSON original (NVD)
Mostrar
{
"id": "CVE-2017-7484",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"vendor": "The PostgreSQL Global Development Group",
"product": "PostgreSQL",
"versions": [
{
"status": "affected",
"version": "9.2 - 9.6"
}
]
}
]
}
],
"published": "2017-05-12T19:29:00.193",
"references": [
{
"url": "http://www.debian.org/security/2017/dsa-3851",
"source": "secalert@redhat.com"
},
{
"url": "http://www.securityfocus.com/bid/98459",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "secalert@redhat.com"
},
{
"url": "http://www.securitytracker.com/id/1038476",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1677",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1678",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1838",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1983",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:2425",
"source": "secalert@redhat.com"
},
{
"url": "https://security.gentoo.org/glsa/201710-06",
"source": "secalert@redhat.com"
},
{
"url": "https://www.postgresql.org/about/news/1746/",
"tags": [
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "http://www.debian.org/security/2017/dsa-3851",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/98459",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1038476",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1677",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1678",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1838",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:1983",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2017:2425",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.gentoo.org/glsa/201710-06",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.postgresql.org/about/news/1746/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"description": [
{
"lang": "en",
"value": "CWE-285"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access."
},
{
"lang": "es",
"value": "Se ha descubierto que algunas funciones de estimación de selectividad en PostgreSQL, en versiones anteriores a la 9.2.21, versiones 9.3.x anteriores a la 9.3.17, versiones 9.4.x anteriores a la 9.4.12, versiones 9.5.x anteriores a la 9.5.7 y versiones 9.6.x anteriores a la 9.6.3, no verificaban los privilegios de usuario antes de ofrecer información de pg_statistic, lo que probablemente implique un filtrado de información. Un atacante sin privilegios podría utilizar este fallo para robar información de tablas a las que, de otra forma, no tendría acceso."
}
],
"lastModified": "2026-06-17T01:24:26.570",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "20D48E22-78D1-461D-ABE1-C8F578A17CB7",
"versionEndIncluding": "9.2.20"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5B890251-95EB-44F3-A6A7-F718F3C807B0"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2E5BD02-8C3D-4687-88DE-1C00366270E7"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "709F5DF9-9F3A-42C3-890B-521B13118C0E"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "14D85A34-C897-4E52-8F97-18CA51C5461A"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A40DAD2B-A6D4-43D8-B282-A3C672356D6A"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC2FE391-9414-480E-A9B1-CF70280E315E"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55B6A4ED-FA3B-4251-BF82-755F95277CF9"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C7142DF3-124D-43D7-ADD9-70F4F7298557"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28DEA438-A0ED-49DC-AE51-4E9D8D4B6E7B"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "810B184F-6FB8-48D8-A569-F47BA43C4862"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "064BF155-7E2D-47B9-BD2B-C6E9FC06F5FC"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "676A81BD-7EEE-4770-B9AC-451B09844D6C"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30F23D38-BDD6-48E6-A6B2-29CD962EED99"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "89833234-3890-4E2E-8FCF-09925D83ED67"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8F3ACC3-CB15-47E3-A511-E1D1F75E797F"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.15:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F6FD785-7C9F-4302-B7ED-93CA04473ACE"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.3.16:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC1BA72C-3A6E-450B-A3DE-3898DEAA9225"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77D1323D-3096-4D0F-823A-ECAC9017646D"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A587AF3-5E70-4455-8621-DFD048207DE2"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "526AFF26-B3EC-41C3-AC4C-85BFA3F99AC8"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "89D2CAB7-C3D9-4F21-B902-2E498D00EFEB"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "88797795-8B1C-455F-8C52-6169B2E47D53"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DBDE0CC8-F1DF-4723-8FCB-9A33EA8B12D3"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "90F13667-019B-49DF-929C-3D376FCDE6E4"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B9E20AA3-C0D3-492C-AF3B-9F61550E6983"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "251C78CA-EEC0-49A8-A3D2-3C86D16CCB7F"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB443A75-2466-4164-A71B-9203933CB0D6"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B02839D4-EE7D-4D42-8934-322E46B643D4"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.4.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1BAE807-A21F-4980-B64E-911F5E9B16BF"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9FF7FC5B-C9E3-4109-B3D6-9AC06F75DCB3"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2C15A86-9ED9-492E-877B-86963DAA761A"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9EF74623-EF0E-455D-ADEB-9E336B539D86"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.5.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FACD7AB7-34E9-4DFC-A788-7B9BF745D780"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.5.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F8E8AEBB-9968-458D-8EE4-2725BBE1A53F"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.5.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7ECC17E6-C5FF-4B63-807A-26E5E6932C5C"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.5.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7DB72357-B16D-488A-995C-2703CCEC1D8F"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7040466B-2A7D-4E75-8E4F-FA70D4A7E014"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "44887DE9-506B-46E3-922C-7B3C14B0AF33"
},
{
"criteria": "cpe:2.3:a:postgresql:postgresql:9.6.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D1250F15-7A05-452A-8958-3B1B32B326E1"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secalert@redhat.com"
}