CVE-2023-39417
highpriority · track · 36EPSS 0.017 · 77 %ileCHDEEURUUSEPSS · scored 2026-10-22
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedS+ Engineering abb_psirt
ABB advises all customers to review their installations to determine if they are using an impacted product as listed above, no further analysis or tools are needed to make this determination. The recommended immediate actions per product are listed below: - Systems using S+ Engineering 2.2 through 2.4 SP2 should upgrade to S+ Engineering 2.4 SP2 RU1 (re-leased in December 2024) or later. - End users who are unable to install one of these updates should immediately look to implement the Mitigation and Workarounds listed below as this will restrict or prevent an attacker’s ability to com-promise the system. ABB recommends that customers apply the update at the earliest convenience.
- FixedSINEC NMSsiemens_psirt
Update to V2.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109826954/ - FixedSINEC NMScisa_csaf_ot
Update to V2.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109826954/ - FixedS+ Engineering cisa_csaf_ot
ABB advises all customers to review their installations to determine if they are using an impacted product as listed above, no further analysis or tools are needed to make this determination. The recommended immediate actions per product are listed below: - Systems using S+ Engineering 2.2 through 2.4 SP2 should upgrade to S+ Engineering 2.4 SP2 RU1 (re-leased in December 2024) or later. - End users who are unable to install one of these updates should immediately look to implement the Mitigation and Workarounds listed below as this will restrict or prevent an attacker’s ability to com-promise the system. ABB recommends that customers apply the update at the earliest convenience.
- MitigationS+ Engineering abb_psirt
Any exploit of these vulnerabilities would require that the attacker has access to the site’s S+ client/server network. Following ABB’s recommended security practices, including network architecture and perimeter firewall, are mitigating factors in preventing external access to the S+ client/server net-work. Refer to section “General security recommendations” for further advise on how to keep your system secure.
- MitigationS+ Engineering cisa_csaf_ot
Any exploit of these vulnerabilities would require that the attacker has access to the site’s S+ client/server network. Following ABB’s recommended security practices, including network architecture and perimeter firewall, are mitigating factors in preventing external access to the S+ client/server net-work. Refer to section “General security recommendations” for further advise on how to keep your system secure.
- WorkaroundS+ Engineering abb_psirt
No workarounds are available. Assess the installation specific risk based on this advisory. Use the recommendations described under “Mitigating factors” or “Recommended immediate actions”.
- WorkaroundS+ Engineering cisa_csaf_ot
No workarounds are available. Assess the installation specific risk based on this advisory. Use the recommendations described under “Mitigating factors” or “Recommended immediate actions”.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (105)
Products and version ranges known to be affected.
advisories (8)
Vendor and ecosystem advisories describing this.
- 7PAA017341PostgreSQL vulnerabilities in ABB Ability™ Symphony® Plus Engineering2026-04-13csaf · abb_psirtCH
ABB became aware of vulnerability in the products versions listed as affected in the advisory. The ABB S+ Engineering product versions are affected by vulnerabilities in PostgreSQL version 13.11 and earlier versions. If an attacker gains access to a site’s S+ Client Server network, they could exploit such vulnerabilities by executing arbitrary code and potentially compromising the entire system.
- SSA-943925SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP12024-02-13csaf · siemens_psirtDE
SINEC NMS before V2.0 SP1 is affected by multiple vulnerabilities. Siemens has released an update for SINEC NMS and recommends to update to the latest version.
- WID-SEC-W-2023-2038PostgreSQL: Mehrere SchwachstellenDeutsch2023-08-10csaf · cert_bundDE
Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Code auszuführen oder Sicherheitsmaßnahmen zu umgehen.
- WID-SEC-W-2023-3041GitLab: Mehrere SchwachstellenDeutsch2023-11-30csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, seine Berechtigungen zu erweitern oder XSS-Angriffe durchzuführen.
- WID-SEC-W-2024-0054IBM Security Verify Access: Mehrere SchwachstellenDeutsch2024-01-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM Security Verify Access ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern oder komplexe Angriffe wie Cache Poisoning, Cross-Site-Scripting oder Session-Hijacking durchzuführen.
- ICSA-24-046-15Siemens SINEC NMS2024-02-13icsa · cisa_csaf_otUS
SINEC NMS before V2.0 SP1 is affected by multiple vulnerabilities. Siemens has released an update for SINEC NMS and recommends to update to the latest version.
- ICSA-26-120-06ABB Ability Symphony Plus Engineering2026-04-13icsa · cisa_csaf_otUS
ABB became aware of vulnerability in the products versions listed as affected in the advisory. The ABB S+ Engineering product versions are affected by vulnerabilities in PostgreSQL version 13.11 and earlier versions. If an attacker gains access to a site’s S+ Client Server network, they could exploit such vulnerabilities by executing arbitrary code and potentially compromising the entire system.
- BIT-postgresql-2023-39417Postgresql: extension script @substitutions@ within quoting allow sql injection2024-03-06vendor · osvUS
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (73)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/CVE-2023-39417cnnvd
- https://access.redhat.com/security/cve/cve-2023-39417cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=2228111cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-39417/cnnvd
- https://lists.debian.org/debian-lts-announce/2023/10/msg00003.htmlcnnvd
- https://security.netapp.com/advisory/ntap-20230915-0002/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.4767cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.4850cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan