CVE-2024-0985 : Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allo

Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a superuser or member of one of the attacker's roles. The attack requires luring the victim into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. Versions before PostgreSQL 16.2, 15.6, 14.11, 13.14, and 12.18 are affected.

Published 2024-02-08 13:15:09

Updated 2024-12-20 13:15:19

Source PostgreSQL

View at NVD, CVE.org

Products affected by CVE-2024-0985

Postgresql » Postgresql
Versions from including (>=) 14.0 and before (<) 14.11
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
Matching versions
Postgresql » Postgresql
Versions from including (>=) 13.0 and before (<) 13.14
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
Matching versions
Postgresql » Postgresql
Versions from including (>=) 12.0 and before (<) 12.18
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
Matching versions
Postgresql » Postgresql
Versions from including (>=) 15.0 and before (<) 15.6
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2024-0985

EPSS FAQ

0.24%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 48 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2024-0985

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
8.0	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	2.1	5.9	PostgreSQL	2024-02-08
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.0	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	2.1	5.9	NIST	2024-02-15
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.0	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	N/A	N/A	RedHat-CVE-2024-0985	2024-02-08
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2024-0985

CWE-271 Privilege Dropping / Lowering Errors

The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.

Assigned by: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 (Secondary)

References for CVE-2024-0985

https://security.netapp.com/advisory/ntap-20241220-0005/

CVE-2024-0985 PostgreSQL Vulnerability in NetApp Products | NetApp Product Security
https://lists.debian.org/debian-lts-announce/2024/03/msg00017.html

[SECURITY] [DLA 3764-1] postgresql-11 security update
https://www.postgresql.org/support/security/CVE-2024-0985/

PostgreSQL: Not Found
Vendor Advisory
https://saites.dev/projects/personal/postgres-cve-2024-0985/

Constructing a Postgres Privilege Escalation Exploit - saites.dev

Jump to

Vulnerability Details : CVE-2024-0985

Products affected by CVE-2024-0985

Exploit prediction scoring system (EPSS) score for CVE-2024-0985

CVSS scores for CVE-2024-0985

CWE ids for CVE-2024-0985

References for CVE-2024-0985