CVE-2025-31480

Katalog CVE

CVSS 9.1 · Critical EPSS 0,49%

Kerentanan Untrusted Search Path. Skor CVSS 3.1 9.1 (Critical) menurut github.com.

Deskripsi (NVD)

aiven-extras is a PostgreSQL extension. This is a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages the format function not being schema-prefixed. Affected users should install 1.1.16 and ensure they run the latest version issuing ALTER EXTENSION aiven_extras UPDATE TO '1.1.16' after installing it. This needs to happen in each database aiven_extras has been installed in.

Rincian

Terbit di NVD

4 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

9.1 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-426: Untrusted Search Path

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/aiven/aiven-extras/commit/77b5f19a0c1d196bc741ff5c774f85fe7ca3063b
• https://github.com/aiven/aiven-extras/security/advisories/GHSA-33xh-jqgf-6627