PostgreSQL up to 15.3 Extension Script sql injection

Summaryinfo

A vulnerability was found in PostgreSQL up to 11.20/12.15/13.11/14.8/15.3 and classified as critical. This vulnerability affects unknown code of the component Extension Script Handler. Such manipulation leads to sql injection. This vulnerability is traded as CVE-2023-39417. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in PostgreSQL up to 11.20/12.15/13.11/14.8/15.3 (Database Software). Affected by this issue is an unknown code of the component Extension Script Handler. The manipulation with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability.

The weakness was shared 08/11/2023. The advisory is available at postgresql.org. This vulnerability is handled as CVE-2023-39417 since 08/01/2023. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1505 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 216614 (Oracle Linux 9 : postgresql:15 (ELSA-2025-1741)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 11.21, 12.16, 13.12, 14.9 or 15.4 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (216614) and EUVD (EUVD-2023-43141). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Database Software

Name

• PostgreSQL

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6
• 11.7
• 11.8
• 11.9
• 11.10
• 11.11
• 11.12
• 11.13
• 11.14
• 11.15
• 11.16
• 11.17
• 11.18
• 11.19
• 11.20
• 12.0
• 12.1
• 12.2
• 12.3
• 12.4
• 12.5
• 12.6
• 12.7
• 12.8
• 12.9
• 12.10
• 12.11
• 12.12
• 12.13
• 12.14
• 12.15
• 13.0
• 13.1
• 13.2
• 13.3
• 13.4
• 13.5
• 13.6
• 13.7
• 13.8
• 13.9
• 13.10
• 13.11
• 14.0
• 14.1
• 14.2
• 14.3
• 14.4
• 14.5
• 14.6
• 14.7
• 14.8
• 15.0
• 15.1
• 15.2
• 15.3

License

• open-source

Website

• Product: https://www.postgresql.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion