{"api_version":"1","generated_at":"2026-07-23T06:18:13+00:00","cve":"CVE-2017-15099","urls":{"html":"https://cve.report/CVE-2017-15099","api":"https://cve.report/api/cve/CVE-2017-15099.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-15099","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-15099"},"summary":{"title":"CVE-2017-15099","description":"INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.","state":"PUBLISHED","assigner":"redhat","published_at":"2017-11-22 18:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-200","CWE-200 CWE-200"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"https://www.postgresql.org/support/security/","name":"https://www.postgresql.org/support/security/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Vendor Advisory"],"title":"PostgreSQL: Security Information","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1039752","name":"http://www.securitytracker.com/id/1039752","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"PostgreSQL Bugs Let Remote Authenticated Users Bypass Access Controls and Obtain Potentially Sensitive Information and Let Local Users Modify Files on the Target System - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2018:2566","name":"https://access.redhat.com/errata/RHSA-2018:2566","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.postgresql.org/about/news/1801/","name":"https://www.postgresql.org/about/news/1801/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Vendor Advisory"],"title":"PostgreSQL: PostgreSQL 10.1, 9.6.6, 9.5.10, 9.4.15, 9.3.20, and 9.2.24 released!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/101781","name":"http://www.securityfocus.com/bid/101781","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"PostgreSQL Multipe Memory Corruption and Security Bypass Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2018:2511","name":"https://access.redhat.com/errata/RHSA-2018:2511","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.debian.org/security/2017/dsa-4028","name":"https://www.debian.org/security/2017/dsa-4028","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"],"title":"Debian -- Security Information -- DSA-4028-1 postgresql-9.6","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15099","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15099","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Red Hat, Inc.","product":"postgresql","version":"affected 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.5.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.5.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.5.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.5.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.5.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.5.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.5.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.5.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.5.9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.6.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.6.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.6.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.6.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"15099","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"postgresql","cpe5":"postgresql","cpe6":"9.6.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2017","cve_id":"15099","cve":"CVE-2017-15099","epss":"0.271110000","percentile":"0.964320000","score_date":"2026-05-14","updated_at":"2026-05-15 00:08:13"},"legacy_qids":[{"cve":"CVE-2017-15099","qid":"500529","title":"Alpine Linux Security Update for postgresql"},{"cve":"CVE-2017-15099","qid":"501997","title":"Alpine Linux Security Update for postgresql14"},{"cve":"CVE-2017-15099","qid":"502763","title":"Alpine Linux Security Update for postgresql15"},{"cve":"CVE-2017-15099","qid":"504296","title":"Alpine Linux Security Update for postgresql14"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T19:50:16.128Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"101781","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/101781"},{"name":"RHSA-2018:2511","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2018:2511"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.postgresql.org/support/security/"},{"name":"1039752","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1039752"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://www.postgresql.org/about/news/1801/"},{"name":"RHSA-2018:2566","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"https://access.redhat.com/errata/RHSA-2018:2566"},{"name":"DSA-4028","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"https://www.debian.org/security/2017/dsa-4028"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"postgresql","vendor":"Red Hat, Inc.","versions":[{"status":"affected","version":"10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10"}]}],"datePublic":"2017-11-09T00:00:00.000Z","descriptions":[{"lang":"en","value":"INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2018-08-28T09:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"101781","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/101781"},{"name":"RHSA-2018:2511","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2018:2511"},{"tags":["x_refsource_MISC"],"url":"https://www.postgresql.org/support/security/"},{"name":"1039752","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1039752"},{"tags":["x_refsource_CONFIRM"],"url":"https://www.postgresql.org/about/news/1801/"},{"name":"RHSA-2018:2566","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2018:2566"},{"name":"DSA-4028","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"https://www.debian.org/security/2017/dsa-4028"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","DATE_PUBLIC":"2017-11-09T00:00:00","ID":"CVE-2017-15099","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"postgresql","version":{"version_data":[{"version_value":"10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10"}]}}]},"vendor_name":"Red Hat, Inc."}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-200"}]}]},"references":{"reference_data":[{"name":"101781","refsource":"BID","url":"http://www.securityfocus.com/bid/101781"},{"name":"RHSA-2018:2511","refsource":"REDHAT","url":"https://access.redhat.com/errata/RHSA-2018:2511"},{"name":"https://www.postgresql.org/support/security/","refsource":"MISC","url":"https://www.postgresql.org/support/security/"},{"name":"1039752","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1039752"},{"name":"https://www.postgresql.org/about/news/1801/","refsource":"CONFIRM","url":"https://www.postgresql.org/about/news/1801/"},{"name":"RHSA-2018:2566","refsource":"REDHAT","url":"https://access.redhat.com/errata/RHSA-2018:2566"},{"name":"DSA-4028","refsource":"DEBIAN","url":"https://www.debian.org/security/2017/dsa-4028"}]}}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2017-15099","datePublished":"2017-11-22T18:00:00.000Z","dateReserved":"2017-10-08T00:00:00.000Z","dateUpdated":"2024-09-16T16:43:27.924Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-11-22 18:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-200","CWE-200 CWE-200"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.5:*:*:*:*:*:*:*","matchCriteriaId":"9FF7FC5B-C9E3-4109-B3D6-9AC06F75DCB3"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.5.1:*:*:*:*:*:*:*","matchCriteriaId":"D2C15A86-9ED9-492E-877B-86963DAA761A"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.5.2:*:*:*:*:*:*:*","matchCriteriaId":"9EF74623-EF0E-455D-ADEB-9E336B539D86"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.5.3:*:*:*:*:*:*:*","matchCriteriaId":"FACD7AB7-34E9-4DFC-A788-7B9BF745D780"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.5.4:*:*:*:*:*:*:*","matchCriteriaId":"F8E8AEBB-9968-458D-8EE4-2725BBE1A53F"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.5.5:*:*:*:*:*:*:*","matchCriteriaId":"7ECC17E6-C5FF-4B63-807A-26E5E6932C5C"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.5.6:*:*:*:*:*:*:*","matchCriteriaId":"7DB72357-B16D-488A-995C-2703CCEC1D8F"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.5.7:*:*:*:*:*:*:*","matchCriteriaId":"B9671475-BC67-436F-B2B1-5128347B3C64"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.5.8:*:*:*:*:*:*:*","matchCriteriaId":"2EC098A3-1989-4AA5-B8D5-E061A618519D"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.5.9:*:*:*:*:*:*:*","matchCriteriaId":"D2ABACB8-F4B0-4635-8FC7-4B0F5B723241"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.6:*:*:*:*:*:*:*","matchCriteriaId":"7040466B-2A7D-4E75-8E4F-FA70D4A7E014"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.6.1:*:*:*:*:*:*:*","matchCriteriaId":"44887DE9-506B-46E3-922C-7B3C14B0AF33"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.6.2:*:*:*:*:*:*:*","matchCriteriaId":"D1250F15-7A05-452A-8958-3B1B32B326E1"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.6.3:*:*:*:*:*:*:*","matchCriteriaId":"A18FEF31-B528-46A8-AAA8-63B30D5A10EC"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.6.4:*:*:*:*:*:*:*","matchCriteriaId":"A35D61BD-50A7-4ACF-BA62-8F56C0740DA5"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:9.6.5:*:*:*:*:*:*:*","matchCriteriaId":"546FEA34-A6D9-47C4-A5B2-F492E1457F09"},{"vulnerable":true,"criteria":"cpe:2.3:a:postgresql:postgresql:10.0:*:*:*:*:*:*:*","matchCriteriaId":"97465EF2-1B00-4210-9F58-643A2C6198D2"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"15099","Ordinal":"1","Title":"CVE-2017-15099","CVE":"CVE-2017-15099","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"15099","Ordinal":"1","NoteData":"INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.","Type":"Description","Title":"CVE-2017-15099"},{"CveYear":"2017","CveId":"15099","Ordinal":"2","NoteData":"2017-11-22","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"15099","Ordinal":"3","NoteData":"2018-08-28","Type":"Other","Title":"Modified"}]}}}