CVE-2017-7486 Information disclosure in PostgreSQL
An attacker with USAGE privilege can read foreign server passwords via the pg_user_mappings view, exposing sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-7486?
CVE-2017-7486 is a high-severity vulnerability in Postgresql Postgresql, published on 12 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.
Which versions are affected by CVE-2017-7486?
It affects 1 product.
Products include Postgresql Postgresql.
How do I fix CVE-2017-7486?
Upgrade to a fixed version.
Is CVE-2017-7486 being exploited?
There is no known exploitation of CVE-2017-7486 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as ALPINE-CVE-2017-7486, CLEANSTART-2026-KM02734, GHSA-cxxw-q5xv-pww9, UBUNTU-CVE-2017-7486.