CVE-2023-41120 : What You Need to Know
CVE-2023-41120 allows authenticated users to delete all profiling data across the system in EnterpriseDB Postgres Advanced Server versions before 11.21.32, 12.x, 13.x, 14.x, and 15.x.
An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) that affects versions before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. This vulnerability allows an authenticated user to use DBMS_PROFILER to remove all accumulated profiling data system-wide, regardless of their permissions.
Understanding CVE-2023-41120
This section provides insights into the impact and technical details of CVE-2023-41120.
What is CVE-2023-41120?
CVE-2023-41120 is a security flaw in EnterpriseDB Postgres Advanced Server that enables authenticated users to delete all profiling data across the system using DBMS_PROFILER.
The Impact of CVE-2023-41120
The vulnerability poses a medium-severity risk, with a CVSS base score of 6.5. An attacker can exploit this issue to impact the integrity of the system by removing profiling data.
Technical Details of CVE-2023-41120
Let's delve deeper into the specifics of the vulnerability.
Vulnerability Description
The flaw allows any authenticated user to execute DBMS_PROFILER and delete all profiling data on the entire system, irrespective of their access permissions.
Affected Systems and Versions
EnterpriseDB Postgres Advanced Server versions before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0 are vulnerable to this issue.
Exploitation Mechanism
An authenticated user can misuse the DBMS_PROFILER functionality to wipe out all accumulated profiling data system-wide, even without necessary permissions.
Mitigation and Prevention
Discover the steps to mitigate the risks posed by CVE-2023-41120.
Immediate Steps to Take
Ensure to update the EnterpriseDB Postgres Advanced Server to the patched versions to prevent exploitation of this vulnerability.
Long-Term Security Practices
Enforce the principle of least privilege to limit access to critical functionalities like DBMS_PROFILER.
Patching and Updates
Regularly monitor security advisories from EnterpriseDB and apply updates promptly to safeguard against known vulnerabilities.