PT-2023-19036 · Pg Ivm · Pg Ivm

Yugo-N · Published 2023-03-07 · Updated 2023-03-14 · CVE-2023-23554

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pg ivm versions prior to 1.5.1

Description An uncontrolled search path element issue exists. When refreshing an IMMV, pg ivm executes functions without specifying schema names, potentially allowing it to be tricked into executing unexpected functions from other schemas with the IMMV owner's privilege. If exploited, an attacker-provided function may be executed with the materialized view owner's privilege.

Recommendations For versions prior to 1.5.1, update to version 1.5.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the IMMV refresh function to minimize the risk of exploitation.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2023-23554

Affected Products

Pg Ivm

References · 6

• https://osv.dev/vulnerability/CVE-2023-23554 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23554 · Security Note
• https://github.com/sraoss/pg_ivm · Note
• https://github.com/sraoss/pg_ivm/releases/tag/v1.5.1 · Note
• https://jvn.jp/en/jp/JVN19872280 · Note
• https://t.me/cvenotify/45685 · Telegram Post