Vulnerability Description
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Postgresql | Postgresql | >= 11.0, < 11.20 |
| Redhat | Software Collections | - |
| Redhat | Enterprise Linux | 8.0 |
| Fedoraproject | Fedora | 38 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/security/cve/CVE-2023-2454Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2454/Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-2454Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2454/Vendor Advisory
FAQ
What is CVE-2023-2454?
CVE-2023-2454 is a vulnerability with a CVSS score of 7.2 (HIGH). schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitra...
How severe is CVE-2023-2454?
CVE-2023-2454 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-2454?
Check the references section above for vendor advisories and patch information. Affected products include: Postgresql Postgresql, Redhat Software Collections, Redhat Enterprise Linux, Fedoraproject Fedora.