CVE-2021-3393

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. An attacker could use this flaw to obtain information stored in a column they are allowed to write but not read.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

Vendor	Product	Versions
n/a	postgresql	postgresql 13.2, postgresql 12.6, postgresql 11.11

References

https://bugzilla.redhat.com/show_bug.cgi?id=1924005Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202105-32Third Party Advisory
https://security.netapp.com/advisory/ntap-20210507-0006/Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1924005Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202105-32Third Party Advisory
https://security.netapp.com/advisory/ntap-20210507-0006/Third Party Advisory

Timeline

Published: Apr 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-339307.5Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows attackers to cause a D CVE-2021-339387.5Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attackers to cause a Denial o CVE-2021-33948.8Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder permissions allowing a CVE-2021-339459.8RICOH Printer series SP products 320DN, SP 325DNw, SP 320SN, SP 320SFN, SP 325SNw, SP 325SFNw, SP 330SN, Aficio SP 3500SF, SP 221S, SP 220SN CVE-2021-339489.8SQL injection vulnerability in FantasticLBP Hotels Server v1.0 allows attacker to execute arbitrary code via the username parameter.CVE-2021-339499.8An issue in FeMiner WMS v1.1 allows attackers to execute arbitrary code via the filename parameter and the exec function.CVE-2021-33955.4A cross-site scripting (XSS) vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary file. The JavaScript CVE-2021-339507.5An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function.CVE-2021-339597.5Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.CVE-2021-33968.8OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <CVE-2021-339616.1A Cross Site Scripting (XSS) vulnerabililty exists in enhanced-github v5.0.11 via the file name parameter.CVE-2021-339629.8China Mobile An Lianbao WF-1 router v1.0.1 is affected by an OS command injection vulnerability in the web interface /api/ZRUsb/pop_usb_devi