What is CVE-2009-3231?

CVE-2009-3231 is a vulnerability in PostgreSQL, classified under Improper Authentication. Published 2009-09-17.

Is CVE-2009-3231 known to be exploited?

12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in PostgreSQL

CVE-2009-3231

The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.

Vulnerability class: Broken Authentication

Published 2009-09-17 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 6.8 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.076 (94.3th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 94.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.076 · newest: 0.076 · change: 0.000

Affected products

PostgreSQL
Canonical Ubuntu Linux — versions 6.06, 8.04, 8.10
Fedoraproject Fedora — versions 10, 11
openSUSE
SUSE Linux Enterprise — versions 10.0, 11.0
SUSE Linux Enterprise Server — versions 9

Weakness classification (CWE)

CWE-287 — Improper Authentication

Public proof-of-concept exploits

References

www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html (vendor-advisory, Mailing List)
www.postgresql.org/docs/8.3/static/release-8-3-8.html (Release Notes)
www.securityfocus.com/bid/36314 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
marc.info/ (vendor-advisory, Mailing List)
secunia.com/advisories/36837 (Broken Link, third-party-advisory)
www.postgresql.org/support/security.html (Broken Link, Vendor Advisory)
secunia.com/advisories/36660 (Broken Link, Vendor Advisory, third-party-advisory)
www.securityfocus.com/archive/1/509917/100/0/threaded (mailing-list, VDB Entry, Third Party Advisory, Broken Link)
secunia.com/advisories/36800 (Broken Link, third-party-advisory)
www.us.debian.org/security/2009/dsa-1900 (vendor-advisory, Broken Link)

Frequently asked questions

What is CVE-2009-3231?: CVE-2009-3231 is a vulnerability in PostgreSQL, classified under Improper Authentication. Published 2009-09-17.
Is CVE-2009-3231 known to be exploited?: 12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.