Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-2454

schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.

Published

2023-06-09T19:15:09.253

Last Modified

2025-01-06T18:15:13.670

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.2 (HIGH)

Weaknesses

Type: Secondary
CWE-20
Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	postgresql	postgresql	< 11.20	Yes
Application	postgresql	postgresql	< 12.15	Yes
Application	postgresql	postgresql	< 13.11	Yes
Application	postgresql	postgresql	< 14.8	Yes
Application	postgresql	postgresql	< 15.3	Yes
Application	redhat	software_collections	-	Yes
Operating System	redhat	enterprise_linux	8.0	Yes
Operating System	redhat	enterprise_linux	9.0	Yes
Operating System	fedoraproject	fedora	38	Yes

References

https://access.redhat.com/security/cve/CVE-2023-2454 Third Party Advisory ([email protected])
https://security.netapp.com/advisory/ntap-20230706-0006/ ([email protected])
https://www.postgresql.org/support/security/CVE-2023-2454/ Vendor Advisory ([email protected])
https://access.redhat.com/security/cve/CVE-2023-2454 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20230706-0006/ (af854a3a-2127-422b-91ae-364da2661108)
https://www.postgresql.org/support/security/CVE-2023-2454/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)