Unscored severity · published Jun 19, 2007
CVE-2007-3279
PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote…
–
CVSS
2.6%
EPSS
No
On KEV
Description
PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing attacks, which may evade intrusion detection.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
PostgreSQL · PostgreSQL
8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-3279
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-3279
osvdb.org
http://osvdb.org/40900
www.leidecker.info
http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDKSA-2007:188
www.portcullis.co.uk
http://www.portcullis.co.uk/uplds/whitepapers/Having_Fun_With_PostgreSQL.pdf
www.securityfocus.com
http://www.securityfocus.com/archive/1/471541/100/0/threaded
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/35144
More from PostgreSQL
9.8
CVE-2024-24213
Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query
9.8
CVE-2015-0244
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message,…
9.8
CVE-2015-3166
The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call…
9.8
CVE-2019-10211
Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory
9.8
CVE-2018-16850
postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER