CVE-2024-4317
MediumSummary
Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise see.
Risk Assessment
An unprivileged user can access sensitive statistical data, compromising the confidentiality of other users' data.
Recommendation
Update PostgreSQL to the patched version and restrict access to pg_stats_ext and pg_stats_ext_exprs views for unauthorized users.
Original NVD description (English source)
Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not other