CVE-2017-15099CWE-200

CVE-2017-15099: vulnerability in Red Hat, Inc. postgresql

Published · Updated

Follow this CVE+ Monitor postgresql+ Monitor postgresql15

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 6.3%
INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.
Affected products
Red Hat, Inc. · postgresql
Related CVEs — Red Hat, Inc. postgresql

In the same product, most dangerous first.

CVE-2017-15098—CVE-2017-15098EPSS 3.7%CVE-2017-12172—CVE-2017-12172EPSS 0.6%