Lucene search

[email protected]CVE-2023-41117

HistoryDec 12, 2023 - 7:15 a.m.

CVE-2023-41117

2023-12-1207:15:44

CWE-427

[email protected]

web.nvd.nist.gov

cve

epas

security

postgresql

search_path

vulnerability

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contain packages, standalone packages, and functions that run SECURITY DEFINER but are inadequately secured against search_path attacks.

Affected configurations

NVD

Node

enterprisedbpostgres_advanced_serverRange<11.21.32

enterprisedbpostgres_advanced_serverRange12.0.0–12.16.20

enterprisedbpostgres_advanced_serverRange13.0.0–13.12.17

enterprisedbpostgres_advanced_serverRange14.0.0–14.9.0

enterprisedbpostgres_advanced_serverRange15.0.0–15.4.0

CPENameOperatorVersion
enterprisedb:postgres_advanced_serverenterprisedb postgres advanced serverlt11.21.32
enterprisedb:postgres_advanced_serverenterprisedb postgres advanced serverlt12.16.20
enterprisedb:postgres_advanced_serverenterprisedb postgres advanced serverlt13.12.17
enterprisedb:postgres_advanced_serverenterprisedb postgres advanced serverlt14.9.0
enterprisedb:postgres_advanced_serverenterprisedb postgres advanced serverlt15.4.0

CPE	Name	Operator	Version
enterprisedb:postgres_advanced_server	enterprisedb postgres advanced server	lt	11.21.32
enterprisedb:postgres_advanced_server	enterprisedb postgres advanced server	lt	12.16.20
enterprisedb:postgres_advanced_server	enterprisedb postgres advanced server	lt	13.12.17
enterprisedb:postgres_advanced_server	enterprisedb postgres advanced server	lt	14.9.0
enterprisedb:postgres_advanced_server	enterprisedb postgres advanced server	lt	15.4.0

References

www.enterprisedb.com/docs/security/advisories/cve202341117/

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

Related for CVE-2023-41117

prion1 nvd1 cvelist1 ibm1