Arbitrary Code Execution Vulnerability in PostgreSQL by Red Hat
CVE-2023-2454

7.2HIGH

Key Information:

Vendor
Postgresql
Status
postgresql
Vendor
CVE Published:
9 June 2023

Summary

A specific vulnerability in PostgreSQL allows authenticated attackers with elevated database-level privileges to execute arbitrary code. The issue arises when certain database calls bypass protective changes to the search_path, potentially compromising the database's integrity. This could lead to unauthorized actions within the database, thereby representing a significant risk for systems that rely on this database management system.

Affected Version(s)

postgresql PostgreSQL 15.3, PostgreSQL 14.8, PostgreSQL 13.11, PostgreSQL 12.15, PostgreSQL 11.20

References

https://access.redhat.com/security/cve/CVE-2023-2454
https://www.postgresql.org/support/security/CVE-2023-2454/
https://security.netapp.com/advisory/ntap-20230706-0006/

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.