CVE-2023-39417

Summary

CVE-2023-39417: A SQL Injection vulnerability exists in PostgreSQL when certain syntax, specifically @extowner@, @extschema@, or @extschema:...@, is used inside quoting constructs in extension scripts. This issue puts databases at risk if an administrator has installed vulnerable, trusted, non-bundled extensions. An attacker with database-level CREATE privileges can exploit this vulnerability to execute arbitrary code as the bootstrap superuser.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.