CVE-2024-4545

HIGH

EnterpriseDB Postgres Advanced Server - Auth Bypass

Title source: llm
STIX 2.1

Description

All versions of EnterpriseDB Postgres Advanced Server (EPAS) from 15.0 prior to 15.7.0 and from 16.0 prior to 16.3.0 may allow users using edbldr to bypass role permissions from pg_read_server_files. This could allow low privilege users to read files to which they would not otherwise have access.

References (3)

Core 3

Scores

CVSS v3 7.7
EPSS 0.0053
EPSS Percentile 40.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-269
Status published
Products (2)
EnterpriseDB/EDB Postgres Advanced Server 15.0 - 15.7.0
EnterpriseDB/EDB Postgres Advanced Server 16.0 - 16.3.0
Published May 14, 2024
Tracked Since Feb 18, 2026