CVE-2023-32305

Katalog CVE

CVSS 8.8 · High EPSS 0,73%

Kerentanan Improper Input Validation pada aiven. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers on privileged functions called by the aiven-extras extension. A low privileged user can create objects that collide with existing function names, which will then be executed instead. Exploiting this vulnerability could allow a low privileged user to acquire `superuser` privileges, which would allow full, unrestricted access to all data and database functions. And could lead to arbitrary code execution or data access on the underlying host as the `postgres` user. The issue has been patched as of version 1.1.9.

Rincian

Terbit di NVD

12 Mei 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 52,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/aiven/aiven-extras/security/advisories/GHSA-7r4w-fw4h-67gp advisory vendor
• https://github.com/aiven/aiven-extras/commit/8682ae01bec0791708bf25791786d776e2fb0250 patch
• https://security.netapp.com/advisory/ntap-20230616-0006/ advisory pihak ketiga