Lucene search

[email protected]NVD:CVE-2023-41119

HistoryDec 12, 2023 - 7:15 a.m.

CVE-2023-41119

2023-12-1207:15:45

CWE-269

[email protected]

web.nvd.nist.gov

enterprisedb postgres advanced server

privilege escalation

function vulnerability

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

19.4%

JSON

An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contains the function _dbms_aq_move_to_exception_queue that may be used to elevate a user’s privileges to superuser. This function accepts the OID of a table, and then accesses that table as the superuser by using SELECT and DML commands.

Affected configurations

NVD

Node

enterprisedbpostgres_advanced_serverRange<11.21.32

enterprisedbpostgres_advanced_serverRange12.0.0–12.16.20

enterprisedbpostgres_advanced_serverRange13.0.0–13.12.17

enterprisedbpostgres_advanced_serverRange14.0.0–14.9.0

enterprisedbpostgres_advanced_serverRange15.0.0–15.4.0

References

www.enterprisedb.com/docs/security/advisories/cve202341119/

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

19.4%

JSON

Related for NVD:CVE-2023-41119

prion1 cve1 cvelist1 ibm1