PostgreSQL Data Exposure Due to INSERT ON CONFLICT Vulnerability
CVE-2017-15099

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Postgresql
Vendor
CVE Published:
22 November 2017

What is CVE-2017-15099?

This vulnerability in PostgreSQL allows attackers to gain unauthorized access to sensitive table contents through the use of INSERT ... ON CONFLICT DO UPDATE commands. The flaw exists in PostgreSQL versions 10.x prior to 10.1, 9.6.x prior to 9.6.6, and 9.5.x prior to 9.5.10, where users lacking SELECT privileges can exploit INSERT and UPDATE capabilities to bypass row-level security policies, exposing data they are otherwise restricted from viewing. This could lead to significant confidentiality and integrity issues within affected database systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

postgresql 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10

References

http://www.securityfocus.com/bid/101781
vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHSA-2018:2511
vendor-advisoryx_refsource_REDHAT
https://www.postgresql.org/support/security/
x_refsource_MISC

EPSS Score

30% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.