CVE-2023-41120: Medium severity EnterpriseDB Advanced Server vulnerability
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It permits an authenticated user to use DBMSPROFILER to remove all accumulated profiling data on a system-wide basis, regardless of that user's permissions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-41120?
CVE-2023-41120 has a moderate severity level allowing authenticated users to remove system-wide profiling data.
How do I fix CVE-2023-41120?
To mitigate CVE-2023-41120, upgrade your installation of EnterpriseDB Postgres Advanced Server to the appropriate patched version based on your current version.
Who is affected by CVE-2023-41120?
CVE-2023-41120 affects users of EnterpriseDB Postgres Advanced Server versions prior to 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0.
What can an attacker do with CVE-2023-41120?
An attacker with valid authentication can exploit CVE-2023-41120 to delete accumulated profiling data from the database system.
Is CVE-2023-41120 related to authentication?
Yes, CVE-2023-41120 requires the attacker to be an authenticated user to exploit the vulnerability.