CVE-2025-12817

{
  "id": "CVE-2025-12817",
  "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
  "published": "2025-11-13T13:15:45.167",
  "lastModified": "2026-10-19T13:10:00.110",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema.  A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail.  Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected."
    },
    {
      "lang": "es",
      "value": "Falta de autorización en el comando CREATE STATISTICS de PostgreSQL permite a un propietario de tabla lograr una denegación de servicio contra otros usuarios de CREATE STATISTICS al crear en cualquier esquema. Un CREATE STATISTICS posterior con el mismo nombre, de un usuario que tenga el privilegio CREATE, entonces fallaría. Las versiones anteriores a PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20 y 13.23 están afectadas."
    }
  ],
  "affected": [
    {
      "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "PostgreSQL",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "18",
              "lessThan": "18.1",
              "versionType": "rpm",
              "status": "affected"
            },
            {
              "version": "17",
              "lessThan": "17.7",
              "versionType": "rpm",
              "status": "affected"
            },
            {
              "version": "16",
              "lessThan": "16.11",
              "versionType": "rpm",
              "status": "affected"
            },
            {
              "version": "15",
              "lessThan": "15.15",
              "versionType": "rpm",
              "status": "affected"
            },
            {
              "version": "14",
              "lessThan": "14.20",
              "versionType": "rpm",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "13.23",
              "versionType": "rpm",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-13T13:59:49.176346Z",
          "id": "CVE-2025-12817",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.postgresql.org/support/security/CVE-2025-12817/",
      "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"
    }
  ]
}