CVE-2021-3393
postgresql: Partition constraint violation errors leak values of denied columns
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · February 11, 2021
Updated · August 5, 2026
Description
An information leak was discovered in postgresql. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-209 · Generation of Error Message Containing Sensitive Information