CVE-2024-4317

Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.

• CWE-862
• CWE-862

• https://www.postgresql.org/support/security/CVE-2024-4317/Mitigation, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20250328-0001/
• https://www.postgresql.org/support/security/CVE-2024-4317/Mitigation, Vendor Advisory

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43164Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2024-43165Improper Limitation of a Pathname to a Restricted Directory …6.5
• CVE-2024-43166Incorrect Default Permissions vulnerability in Apache Dolphi…9.8
• CVE-2024-43167DISPUTE NOTE: this issue does not pose a security risk as it…2.8
• CVE-2024-43168DISPUTE NOTE: this issue does not pose a security risk as it…4.8
• CVE-2024-43169IBM Engineering Requirements Management DOORS Next 7.0.2, 7.…6.5
• CVE-2024-43173IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely …3.7
• CVE-2024-43176IBM OpenPages 9.0 could allow an authenticated user to obtai…5.4
• CVE-2024-43177IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely …9.8
• CVE-2024-43178IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cr…7.5
• CVE-2024-4318The Tutor LMS plugin for WordPress is vulnerable to time-bas…6.5
• CVE-2024-43180IBM Concert 1.0 does not set the secure attribute on authori…4.3