CVE-2023-23554 - Uncontrolled search path element vulnerability exists in pg_ivm versions prior to 1.5.1

Back Back to CVE browser

HIGH

Uncontrolled search path element vulnerability exists in pg_ivm versions prior to 1.5.1

Published Mar 7, 2023

8.8

HIGH

CVSS 3.1

EPSS 0.94%

Description

Uncontrolled search path element vulnerability exists in pg_ivm versions prior to 1.5.1. When refreshing an IMMV, pg_ivm executes functions without specifying schema names. Under certain conditions, pg_ivm may be tricked to execute unexpected functions from other schemas with the IMMV owner's privilege. If this vulnerability is exploited, an unexpected function provided by an attacker may be executed with the privilege of the materialized view owner.

Affected products

Vendor IVM Development Group Product PG Ivm Default
n/a
- Version
  versions prior to 1.5.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IVM Development Group

PG Ivm

n/a

Version	Status	Constraints
versions prior to 1.5.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-427

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-27654
Advisory
https://github.com/sraoss/pg_ivm
Product
https://github.com/sraoss/pg_ivm/releases/tag/v1.5.1
Release Notes
https://jvn.jp/en/jp/JVN19872280/
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-27654		Advisory
https://github.com/sraoss/pg_ivm		Product
https://github.com/sraoss/pg_ivm/releases/tag/v1.5.1		Release Notes
https://jvn.jp/en/jp/JVN19872280/		Third Party Advisory