CVE-2023-41114

CVSS 6.5 MEDIUMEPSS 0.6%

An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contains the functions get_url_as_text and get_url_as_bytea that are publicly executable, thus permitting an authenticated user to read any file from the local filesystem or remote system regardless of that user's permissions.

CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:U/UI:N

Affected products

n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.enterprisedb.com/docs/security/advisories/cve202341114/