Unscored severity · published Jun 19, 2007
CVE-2007-3278
PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library (dblink) is installed, allows remote attackers to access…
–
CVSS
1.3%
EPSS
No
On KEV
Description
PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library (dblink) is installed, allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries via a dblink host parameter that proxies the connection from 127.0.0.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
PostgreSQL · PostgreSQL
7.3 before 7.3.21; 7.4 before 7.4.19; 8.0 before 8.0.15; 8.1 before 8.1.11; 8.2 before 8.2.6 · source: NVD
DL
Debian Linux · Debian
3.1; 4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-3278
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-3278
Third Party Advisory
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154
Broken Link
http://osvdb.org/40899
Broken Link
http://secunia.com/advisories/28376
Broken Link
http://secunia.com/advisories/28437
Broken Link
http://secunia.com/advisories/28438
Broken Link
http://secunia.com/advisories/28445
More from PostgreSQL
9.8
CVE-2024-24213
Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query
9.8
CVE-2015-0244
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message,…
9.8
CVE-2015-3166
The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call…
9.8
CVE-2019-10211
Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory
9.8
CVE-2018-16850
postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER