CVE-2023-22847

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Information disclosure vulnerability exists in pg_ivm versions prior to 1.5.1. An Incrementally Maintainable Materialized View (IMMV) created by pg_ivm may reflect rows with Row-Level Security that the owner of the IMMV should not have access to. As a result, information in tables protected by Row-Level Security may be retrieved by a user who is not authorized to access it.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IVM Development Group	pg_ivm	versions prior to 1.5.1

References

https://github.com/sraoss/pg_ivmProduct
https://github.com/sraoss/pg_ivm/releases/tag/v1.5.1Release Notes
https://jvn.jp/en/jp/JVN19872280/Third Party Advisory
https://github.com/sraoss/pg_ivmProduct
https://github.com/sraoss/pg_ivm/releases/tag/v1.5.1Release Notes
https://jvn.jp/en/jp/JVN19872280/Third Party Advisory

Timeline

Published: Mar 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-228485.5Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potent CVE-2023-228496.1An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.CVE-2023-22854.3The WP Activity Log Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.0. This i CVE-2023-228508.8Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call.CVE-2023-228517.2Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an admin because of an unserialize call.CVE-2023-228526.5Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import_sheet.php.CVE-2023-228538.8Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval.CVE-2023-228547.5The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download a CVE-2023-228559.8Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 8088. A user-controllab CVE-2023-228565.4A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security contex CVE-2023-228575.4A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security contex CVE-2023-228585.3An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs