CVE-2025-12817
Unknown
Unknown - Not Provided
BaseFortify
Vulnerability report for CVE-2025-12817, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2025-11-13
Last updated on: 2025-11-13
Assigner: PostgreSQL
Description
Description
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| postgresql | postgresql | 16.11 |
| postgresql | postgresql | 13.23 |
| postgresql | postgresql | 15.15 |
| postgresql | postgresql | 17.7 |
| postgresql | postgresql | 18.1 |
| postgresql | postgresql | 14.20 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
