UpHeron
All vulnerabilities

Servers and applications

CVE-2024-4317

Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes…

Severity
Medium 4.3
Published
14 May 2024
Last changed
17 Jun 2026
Added to UpHeron
16 Oct 2026
Fixed in
14.12, 15.7, 16.3
Sources
NVD

Affected software

SoftwareAffected versions
PostgreSQLServers and applications · cpe:a:postgresql:postgresql
  • From 14.0 before 14.12
  • From 15.0 before 15.7
  • From 16.0 before 16.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-4317
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-4317