CVE-2025-5690: Cursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic data
PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data using a database cursor or the --insert option of pgdump. This problem occurs only when dynamic masking is enabled, which is not the default setting. The problem is resolved in version 2.2.1
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5690?
The severity of CVE-2025-5690 is considered high due to the potential for sensitive data exposure.
How do I fix CVE-2025-5690?
To fix CVE-2025-5690, disable dynamic masking in PostgreSQL Anonymizer version 2.0 and 2.1 or upgrade to a patched version.
Who is affected by CVE-2025-5690?
CVE-2025-5690 affects users of PostgreSQL Anonymizer versions 2.0 and 2.1 when dynamic masking is enabled.
What types of data can be exposed due to CVE-2025-5690?
CVE-2025-5690 can lead to exposure of original data that should be masked according to the defined rules.
Is there a workaround for CVE-2025-5690?
Currently, the best workaround for CVE-2025-5690 is to disable dynamic masking until a fix is applied.