CVE-2023-39417

HighCVSS 8.8/10Last modified Sep 30, 2026

Description

IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Aug 11, 2023
Last modified: Sep 30, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-394184.3A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies define CVE-2023-394197.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bound CVE-2023-39427.5An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM device CVE-2023-394208.8The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" ac CVE-2023-394217.7The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services suc CVE-2023-394229.8The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are how CVE-2023-394239.1The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator CVE-2023-394248.8A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary cont CVE-2023-394257.8Improper access control in some Intel(R) DSA software before version 23.4.33 may allow an authenticated user to potentially enable escalatio CVE-2023-394277.8In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation o CVE-2023-394295.4Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary s CVE-2023-394310.0Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lac