CVE-2024-4317 [Low] | Security Vulnerability in Postgresql

Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-05-28	0.22%	0.26%	+0.04%
2	2025-06-17	0.06%	0.22%	+0.16%
3	2025-06-14	—	0.06%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-05-28

0.22%

0.26%

+0.04%

2025-06-17

0.06%

0.22%

+0.16%

2025-06-14

—

0.06%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
3.1	3.1	LOW	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:N) Service keeps running; no real outage angle.	1.6	1.4	f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
4.3	3.1	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:N) Service keeps running; no real outage angle.	2.8	1.4	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

3.1

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:N): Service keeps running; no real outage angle.

1.6

1.4

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

4.3

3.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:N): Data isn’t meaningfully altered or forged.
Availability (A:N): Service keeps running; no real outage angle.

2.8

1.4

[email protected]

OS Trackers for CVE-2024-4317

vendor	priority	summary	link
`alpine`	low	CVE-2024-4317: 1 source package rows (postgresql); 1 state rows across 1 repos (edge-main); fixed 0, open 1.	https://security.alpinelinux.org/vuln/CVE-2024-4317
`debian`	unimportant	CVE-2024-4317 unimportant priority: Debian including 2 source packages (postgresql-13, postgresql-15), 2 status rows across 2 suites (bookworm, bullseye): resolved 2.	https://security-tracker.debian.org/tracker/CVE-2024-4317
`gentoo`	normal	CVE-2024-4317: 1 GLSA(s) (202408-06), 1 atom(s) (dev-db/postgresql); latest impact normal.	https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2024-4317
`redhat`	low	—	https://access.redhat.com/security/cve/CVE-2024-4317
`suse`	medium	CVE-2024-4317 severity moderate: SUSE including 524 source package names (0.3.32-3.4:libpq5-16.4-150600.16.5.1, 15.7-20.3:libpq5-16.3-150200.5.13.1, …), 1132 product×package rows across 69 product lines (Container containers/open-webui, Container private-registry/harbor-db, … (69 product lines)): Fixed 507, Known Not Affected 394, Known Affected 231.	https://www.suse.com/security/cve/CVE-2024-4317/
`ubuntu`	medium	CVE-2024-4317 medium priority: Ubuntu including 8 source packages (postgresql-10, postgresql-12, …), 43 status rows across 8 suites (bionic, focal, jammy, mantic, noble, trusty, upstream, xenial): DNE 28, not-affected 9, released 6.	https://ubuntu.com/security/CVE-2024-4317

Affected software / configurations for CVE-2024-4317

Vendor	Product	Version	Raw CPE
postgresql	postgresql	>= 14.0, < 14.12	cpe:2.3:a:postgresql:postgresql::::::::
postgresql	postgresql	>= 15.0, < 15.7	cpe:2.3:a:postgresql:postgresql::::::::
postgresql	postgresql	>= 16.0, < 16.3	cpe:2.3:a:postgresql:postgresql::::::::

References for CVE-2024-4317

URL	Tags
https://www.postgresql.org/support/security/CVE-2024-4317/	Mitigation Vendor Advisory
https://security.netapp.com/advisory/ntap-20250328-0001/

URL

CVE-2024-4317 | PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks

Exploit prediction scoring system (EPSS) score for CVE-2024-4317

Common vulnerability scoring system (CVSS) metrics for CVE-2024-4317

Weakness enumeration for CVE-2024-4317

OS Trackers for CVE-2024-4317

Affected software / configurations for CVE-2024-4317

References for CVE-2024-4317