Dashboard / CVE-2023-39418

CVE-2023-39418

MEDIUM
MEDIUM Priority: 0.05 BB Relevance: 59/100
Published: 2023-08-11 Modified: 2026-11-07 First seen: 2026-11-07 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: None
I: Low
A: None

Description

A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
debian debian_linux 12.0
postgresql postgresql 15.0 – 15.4
redhat enterprise_linux 8.0
redhat enterprise_linux 9.0

References & Advisories (10)

https://access.redhat.com/errata/RHSA-2023:7785
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7883
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7884
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7885
vendor-advisory x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2228112
issue-tracking x_refsource_REDHAT

Bug Bounty Relevance

59 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

4.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS — Exploitation Probability

1.09%
Raw Score 0.010860
Percentile 65.8%
Date 2026-11-13

EPSS Trend

2026-11-13
0.01086
2026-11-12
0.01086
2026-11-10
0.01086
2026-11-09
0.01086
2026-11-08
0.01086
2026-11-07
0.01086
2026-11-06
0.01086

Intelligence Sources

mitre ref →
nvd ref →

External Links