CVEvulnerability

CVE-2023-39417

8.8 HIGH Published 2023-08-11 Modified 2026-09-30 Official page ↗
Status
Modified
Published
2023-08-11
Last modified
2026-09-30
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89

Description

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

Affected configurations

• postgresql postgresql (>= 11.0 < 11.21) • postgresql postgresql (>= 12.0 < 12.16) • postgresql postgresql (>= 13.0 < 13.12) • postgresql postgresql (>= 14.0 < 14.9) • postgresql postgresql (>= 15.0 < 15.4) • redhat software collections • redhat enterprise linux 8.0 • redhat enterprise linux 9.0 • debian debian linux 8.0 • debian debian linux 11.0 • debian debian linux 12.0

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References