CVE-2023-2455
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
| CWE | CWE-20 |
| Vendor | n/a |
| Product | postgresql |
| Ecosystems | |
| Industries | Technology |
| Published | Jun 9, 2023 |
| Last Updated | Jan 6, 2025 |
Stay Ahead of the Next One
Get instant alerts for n/a postgresql
Be the first to know when new medium vulnerabilities affecting n/a postgresql are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
n/a / postgresql
PostgreSQL 15.3, PostgreSQL 14.8, PostgreSQL 13.11, PostgreSQL 12.15, PostgreSQL 11.20