CVE-2017-7547

8.8 highEPSS 5.6%

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 5.6% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-522
Published: 2017-08-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

postgresql:postgresql

References

http://www.debian.org/security/2017/dsa-3935
http://www.debian.org/security/2017/dsa-3936
http://www.securityfocus.com/bid/100275
http://www.securitytracker.com/id/1039142
https://access.redhat.com/errata/RHSA-2017:2677

Check your stack JSON