CVE-2007-3279
PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created...
PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing attacks, which may evade intrusion detection.
Exploit likelihood
What each source reports
NVD Score used
PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing attacks, which may evade intrusion detection.
- Record
CVE-2007-3279- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing attacks, which may evade intrusion detection.
- Record
CVE-2007-3279- Updated
- 2026-11-02
EUVDEUVD-2007-3269 No score
PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing attacks, which may evade intrusion detection.
- Record
EUVD-2007-3269- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8xvj-fhgm-cmm2 No score
PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created...
PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing attacks, which may evade intrusion detection.
- Record
GHSA-8xvj-fhgm-cmm2- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases, references, title | GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3279 is a high vulnerability (CVSS 10.0) in Postgresql, published June 19, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.61%, the 85th percentile. No source names a fixed version.
References
osvdb.org/40900
leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt
mandriva.com/security/advisories?name=MDKSA-2007:188
portcullis.co.uk/uplds/whitepapers/Having_Fun_With_PostgreSQL.pdf
securityfocus.com/archive/1/471541/100/0/threaded
exchange.xforce.ibmcloud.com/vulnerabilities/35144
nvd.nist.gov/vuln/detail/CVE-2007-3279
github.com/advisories/GHSA-8xvj-fhgm-cmm2