CVE-2024-0985

CVSS 3.1 Score 8.0 of 10 (high)

Details

Published Feb 8, 2024
Updated: Mar 18, 2024
CWE ID 271

Summary

CVE-2024-0985 is a vulnerability in PostgreSQL versions before 15.6, 14.11, 13.14, and 12.18 that allows an object creator to execute arbitrary SQL functions as the command issuer. This vulnerability can be exploited by luring a victim, who is a superuser or member of the attacker's roles, into running the "REFRESH MATERIALIZED VIEW CONCURRENTLY" command on the attacker's materialized view. As a result, the attacker can create functions to convert the internally-built temporary table to a view using CREATE RULE. The known exploit does not work in PostgreSQL 16 and later versions. Organizations using affected versions should update to PostgreSQL 15.6, 14.11, 13.14, or 12.18 to remediate this vulnerability and prevent potential unauthorized execution of SQL functions with elevated privileges.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-0985 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options