CVE: CVE-2025-5690
PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data using a database cursor or the –insert option of pg_dump. This issue occurs only when dynamic masking is enabled, which is not the default setting. The problem is resolved in version 2.2.1.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-5690 |
Exploitation
To exploit this vulnerability, an attacker with a masked user account can enable dynamic masking and then utilize a database cursor or the –insert option of pg_dump to access the original data, bypassing the defined masking rules.
Affected Products
- PostgreSQL Anonymizer v2.0: A version that allows dynamic masking but has a vulnerability that can be exploited to access original data.
- PostgreSQL Anonymizer v2.1: Similar to v2.0, this version also contains the same vulnerability under specific conditions.
Mitigation
To mitigate this vulnerability, users should upgrade to PostgreSQL Anonymizer version 2.2.1 or later, where the issue has been resolved. Additionally, disabling dynamic masking if not needed can help prevent exploitation.
References