CVEvulnerability

CVE-2023-41115

6.5 MEDIUM Published 2023-12-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-12-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. When using UTL_ENCODE, an authenticated user can read any large object, regardless of that user's permissions.

Affected configurations

• enterprisedb postgres advanced server (< 11.21.32) • enterprisedb postgres advanced server (>= 12.0.0 < 12.16.20) • enterprisedb postgres advanced server (>= 13.0.0 < 13.12.17) • enterprisedb postgres advanced server (>= 14.0.0 < 14.9.0) • enterprisedb postgres advanced server (>= 15.0.0 < 15.4.0)

References