CVE-2023-2455

Summary

CVE-2023-2455 is a vulnerability affecting PostgreSQL databases that have implemented row security policies using the CREATE POLICY command. This issue arises when user ID changes are disregarded during the inlining process, allowing incorrect policies to be applied in certain cases. This can occur when a query is planned under one role and then executed under another, particularly in situations involving security definer functions or reused common queries across multiple SET ROLES. The consequence of this vulnerability is that unauthorized users may gain permissions to perform otherwise-forbidden reads and modifications.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.