Vulnerability Details : CVE-2023-41119
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contains the function _dbms_aq_move_to_exception_queue that may be used to elevate a user's privileges to superuser. This function accepts the OID of a table, and then accesses that table as the superuser by using SELECT and DML commands.
Products affected by CVE-2023-41119
- cpe:2.3:a:enterprisedb:postgres_advanced_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:enterprisedb:postgres_advanced_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:enterprisedb:postgres_advanced_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:enterprisedb:postgres_advanced_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:enterprisedb:postgres_advanced_server:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-41119
0.18%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 38 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-41119
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
MITRE | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2023-41119
-
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-41119
-
https://www.enterprisedb.com/docs/security/advisories/cve202341119/
EDB Docs - CVE-2023-41119 - EDB Postgres Advanced Server (EPAS) dbms_aq helper function may run arbitrary SQL as a superuserVendor Advisory
Jump to