CVE-2023-31131

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsafe methods to extract tar files within GPPKGs. greenplum-db is vulnerable to path traversal leading to arbitrary file writes. An attacker can use this vulnerability to overwrite data or system files potentially leading to crash or malfunction of the system. Any files which are accessible to the running process are at risk. All users are requested to upgrade to Greenplum Database version 6.23.2 or higher. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-311327.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulneCVE-2023-311337.5Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to memCVE-2023-311345.4Tauri is software for building applications for multi-platform deployment. The Tauri IPC is usually strictly isolated from external websitesCVE-2023-311355.5Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisiCVE-2023-311365.9PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnCVE-2023-311377.5MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer CVE-2023-311386.5DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior tCVE-2023-311397.5DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior tCVE-2023-31147.7Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted bCVE-2023-311406.5OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and cCVE-2023-311415.9OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there isCVE-2023-311425.3Discourse is an open source discussion platform. Prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `te