Paper/Archive/CVE-2023-41117

CVE-2023-41117

mitre — An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x…

EPSS 0.8%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 55.3.553 × 2011.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contain packages, standalone packages, and functions that run SECURITY DEFINER but are inadequately secured against search_path attacks.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

mitre (CNA)8.8CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refenterprisedb.com/docs/security/advisories/cve202341117