Insecure Permissions in MariaDB Allow Command Execution Vulnerability
CVE-2023-39593

Currently unrated

Key Information:

Vendor

MariaDB Foundation

Status
Mariadb
Vendor
CVE Published:
17 October 2024

What is CVE-2023-39593?

The sys_exec function in MariaDB v10.5 exhibits insecure permissions that can potentially be exploited by authenticated attackers to execute arbitrary commands. While the MariaDB Foundation disputes claims of a privilege boundary being crossed, the vulnerability raises concerns about the integrity and security posture of affected systems. Users and administrators should evaluate their configurations and consider implementing mitigations to safeguard their environments from unauthorized command execution.

References

https://github.com/Ant1sec-ops/CVE-2023-39593

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.