CVE-2014-8161

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.

Published: Jan 27, 2020
Updated: Apr 13, 2023
CVE: CVE-2014-8161
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.3
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS v2:

Severity: Low
Score: 4
AV:N/AC:L/Au:S/C:P/I:N/A:N

CWEs:

CWE-209

OWASP TOP 10:

A6 - Security Misconfiguration

Affected Software
References

Software	From	Fixed in
postgresql / postgresql	-	9.0.19
postgresql / postgresql	9.1.0	9.1.15
postgresql / postgresql	9.2.0	9.2.10
postgresql / postgresql	9.3.0	9.3.6
postgresql / postgresql	9.4.0	9.4.1
debian / debian_linux	8.0	8.0.x
debian / debian_linux	7.0	7.0.x

http://www.debian.org/security/2015/dsa-3155
http://www.postgresql.org/about/news/1569/
http://www.postgresql.org/docs/9.4/static/release-9-4-1.html
http://www.postgresql.org/docs/current/static/release-9-0-19.html
http://www.postgresql.org/docs/current/static/release-9-1-15.html
http://www.postgresql.org/docs/current/static/release-9-2-10.html
http://www.postgresql.org/docs/current/static/release-9-3-6.html

Vulnerability Database

289,599

CVE-2014-8161