Lucene search

[email protected]CVE-2023-2454

HistoryJun 09, 2023 - 7:15 p.m.

CVE-2023-2454

2023-06-0919:15:09

CWE-20

[email protected]

web.nvd.nist.gov

1008

cve-2023-2454

schema_element

postgresql

database security

code execution

nvd

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.9%

JSON

schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.

Affected configurations

Vulners

NVD

Node

postgresqlpostgresqlRange≤15.3

postgresqlpostgresqlRange≤14.8

postgresqlpostgresqlRange≤13.11

postgresqlpostgresqlRange≤12.15

postgresqlpostgresqlRange≤11.20

VendorProductVersionCPE
postgresqlpostgresql*cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
postgresqlpostgresql*cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
postgresqlpostgresql*cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
postgresqlpostgresql*cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
postgresqlpostgresql*cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
postgresql	postgresql	*	cpe:2.3:a:postgresql:postgresql::::::::
postgresql	postgresql	*	cpe:2.3:a:postgresql:postgresql::::::::
postgresql	postgresql	*	cpe:2.3:a:postgresql:postgresql::::::::
postgresql	postgresql	*	cpe:2.3:a:postgresql:postgresql::::::::
postgresql	postgresql	*	cpe:2.3:a:postgresql:postgresql::::::::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "postgresql",
    "versions": [
      {
        "version": "PostgreSQL 15.3, PostgreSQL 14.8, PostgreSQL 13.11, PostgreSQL 12.15, PostgreSQL 11.20",
        "status": "affected"
      }
    ]
  }
]