Insecure Permissions in MariaDB Allow Command Execution Vulnerability
CVE-2023-39593

5.6MEDIUM

Key Information:

Vendor

MariaDB Foundation

Status
Mariadb
Vendor
CVE Published:
17 October 2024

What is CVE-2023-39593?

The sys_exec function in MariaDB v10.5 exhibits insecure permissions that can potentially be exploited by authenticated attackers to execute arbitrary commands. While the MariaDB Foundation disputes claims of a privilege boundary being crossed, the vulnerability raises concerns about the integrity and security posture of affected systems. Users and administrators should evaluate their configurations and consider implementing mitigations to safeguard their environments from unauthorized command execution.

References

https://github.com/Ant1sec-ops/CVE-2023-39593
https://seclists.org/fulldisclosure/2012/Dec/39

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.