CVE-2023-41053

lowpriority · track · 13EPSS 0.003 · 21 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.29% (21st) EPSS

CVSS 3.3 · low

Is it mine?

24 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

cvss

Technical severity, 0–10. One row per scoring source.

5.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.1–5.5

v3.13.3lowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nprimary · NVD / NIST USexploitability 1.8 · impact 1.4

v3.15.5mediumAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.13.3lowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.13.3lowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · security-advisories@github.comexploitability 1.8 · impact 1.4

v3.13.1lowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-269USCWE-269US

affected products (24)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Gentoo Linuxall versionscert_bundDEcpe:/o:gentoo:linux:-
Open Source Redis <7.0.13all versionscert_bundDE
Open Source Redis <7.2.1all versionscert_bundDE
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Open Source Redis< 7.0.13cert_bundDE
Open Source Redis< 7.2.1cert_bundDE
Redis7.0.0, → 7.0.13enisa_euvdEU
Redis7.1.0, → 7.2.1enisa_euvdEU
Redis Labs Redis≤ 7.0.13fstec_bduRU
Redis Labs Redis≤ 7.2.1fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.9fstec_bduRU
АО «НТЦ ИТ РОСА» РОСА ХРОМ≤ 12.4fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
redis redis7.0 → 7.0.13nvdUScpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
redis redis= 7.2.0nvdUScpe:2.3:a:redis:redis:*:*:*:*:*:*:*:*
Bitnami keydb7.0.0 → 7.0.13osvUSpkg:bitnami/keydb
Bitnami keydb7.2.0 → 7.2.1osvUSpkg:bitnami/keydb

showing 20 of 24

advisories (5)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-2283Redis: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2023-09-06csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in Redis ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
WID-SEC-W-2024-0106Oracle Communications: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
BIT-keydb-2023-41053Redis SORT_RO may bypass ACL configuration2024-08-22vendor · osvUS
Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
BIT-redis-2023-41053Redis SORT_RO may bypass ACL configuration2024-03-06vendor · osvUS
Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
BIT-valkey-2023-41053Redis SORT_RO may bypass ACL configuration2024-08-22vendor · osvUS
Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

also known as (7)

Other names and identifiers for this entity.

CNNVD-202309-560 cnnvd
EUVD-2023-45576 enisa_euvd
BDU:2023-05475 fstec_bdu
BIT-keydb-2023-41053osv
BIT-redis-2023-41053osv
BIT-valkey-2023-41053osv
GHSA-q4jr-5p56-4xwc osv

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2023-09-06modified 2026-06-17

references (18)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan