Vulnerability in Postgresql
CVE-2007-3278
PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library (dblink) is installed, allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries via a dblink host parameter that proxies the connection from 127.0.0.1.
EPSS: 0.013 (66.5th percentile) — read the EPSS interpretation.
Affected products
- Postgresql
- Debian Debian_linux — versions 3.1, 4.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
- cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory)
- cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- cve@mitre.org (Permissions Required, vdb-entry, x_refsource_VUPEN)
- cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_MANDRIVA)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
Frequently asked questions
- What is CVE-2007-3278?
- CVE-2007-3278 is a vulnerability in Postgresql, classified under CWE-264. Published 2007-06-19.
- Is CVE-2007-3278 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.