CVE-2021-3393
A user having an UPDATE privilege on a partitioned table but lacking the SELECT privilege on some column may be able to acquire denied-column values from an error message. This is similar to CVE-2014-8161 , but the conditions to exploit are more rare. The PostgreSQL project thanks Heikki Linnakangas for reporting this problem.
Version Information
CVSS 3.0
| Overall Score | 3.1 |
|---|---|
| Component | core server |
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
First published: 2021-02-11