CVE-2024-0985

2024-02-0813:15:08

CWE-271

PostgreSQL

web.nvd.nist.gov

113

cve-2024-0985

postgresql

sql functions

privilege drop

materialized view

security vulnerability

nvd

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

26.1%

JSON

Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker’s roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker’s materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.

Affected configurations

Nvd

Node

postgresqlpostgresqlRange12.0–12.18

postgresqlpostgresqlRange13.0–13.14

postgresqlpostgresqlRange14.0–14.11

postgresqlpostgresqlRange15.0–15.6

VendorProductVersionCPE
postgresqlpostgresql*cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
postgresql	postgresql	*	cpe:2.3:a:postgresql:postgresql::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "PostgreSQL",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "16.2",
        "status": "affected",
        "version": "16",
        "versionType": "rpm"
      },
      {
        "lessThan": "15.6",
        "status": "affected",
        "version": "15",
        "versionType": "rpm"
      },
      {
        "lessThan": "14.11",
        "status": "affected",
        "version": "14",
        "versionType": "rpm"
      },
      {
        "lessThan": "13.14",
        "status": "affected",
        "version": "13",
        "versionType": "rpm"
      },
      {
        "lessThan": "12.18",
        "status": "affected",
        "version": "0",
        "versionType": "rpm"
      }
    ]
  }
]