CVE-2023-41115

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-12 · updated 2026-06-17

Description

An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. When using UTL_ENCODE, an authenticated user can read any large object, regardless of that user's permissions.

Affected products

EnterpriseDB Postgres Advanced Server: before 11.21.32; from 12.0.0 before 12.16.20; from 13.0.0 before 13.12.17; from 14.0.0 before 14.9.0; from 15.0.0 before 15.4.0 — fixed in 11.21.32, 12.16.20, 13.12.17, 14.9.0, 15.4.0

How to fix

Upgrade to a fixed version: EnterpriseDB Postgres Advanced Server 11.21.32, 12.16.20, 13.12.17, 14.9.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-41115 or the next vulnerability affects your stack