PT-2023-9609 · Mariadb Foundation · Mariadb
King Cope
·
Publicado
2023-02-27
·
Atualizado
2025-07-11
·
CVE-2023-26785
CVSS v3.1
10
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
MariaDB version 10.5
Description
The issue is related to a remote code execution vulnerability via UDF Code in a Shared Object File, followed by a "create function" statement. This vulnerability is associated with insufficient input validation, which may allow a remote attacker to execute arbitrary code. Note that the MariaDB Foundation disputes this issue, stating that no privilege boundary is crossed.
Recommendations
For MariaDB version 10.5, update to the latest release to mitigate the risks associated with this issue. As a temporary workaround, consider restricting the use of user-defined functions (UDFs) until a patch is available. Avoid using the
create function statement with untrusted input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
RCE
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Mariadb