CVE-2023-2454

HIGH

PostgreSQL >=11.0 <11.20 - Authenticated Remote Code Execution via schema_element

Title source: llm

Description

schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.

References (3)

Core 3

Core References

Third Party Advisory

https://access.redhat.com/security/cve/CVE-2023-2454

Vendor Advisory

https://www.postgresql.org/support/security/CVE-2023-2454/

Vendor Advisory

https://security.netapp.com/advisory/ntap-20230706-0006/

Scores

CVSS v3 7.2

EPSS 0.0023

EPSS Percentile 46.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-20

Status published

Products (5)

fedoraproject/fedora 38

postgresql/postgresql 11.0 - 11.20

redhat/enterprise_linux 8.0

redhat/enterprise_linux 9.0

redhat/software_collections

Published Jun 09, 2023

Tracked Since Feb 18, 2026