CVE Feed

    Dashboard / CVE / CVE-2023-30625

    CVE-2023-30625

    rudder-server is part of RudderStack, an open source Customer Data Platform (CDP). Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution (RCE) due to the `rudder` role in PostgresSQL having superuser permissions by default. Version 1.3.0-rc.1 contains patches for this issue.

    Published:Jun 16, 2023
    Last Modified:Feb 13, 2025
    EPS:Jun 16, 2023
    EPSS Score:0.89911
    CVSS Score:8.8

    Affected Products

    Vendor
    Rudderstack
    Product
    Rudder-server

    Exploits

    https://securitylab.github.com/advisories/GHSL-2022-097_rudder-server/https://securitylab.github.com/advisories/GHSL-2022-097_rudder-server/

    References

    http://packetstormsecurity.com/files/173837/Rudder-Server-SQL-Injection-Remote-Code-Execution.html
    https://github.com/rudderlabs/rudder-server/commit/0d061ff2d8c16845179d215bf8012afceba12a30
    https://github.com/rudderlabs/rudder-server/commit/2f956b7eb3d5eb2de3e79d7df2c87405af25071e
    https://github.com/rudderlabs/rudder-server/commit/9c009d9775abc99e72fc470f4c4c8e8f1775e82a
    https://github.com/rudderlabs/rudder-server/pull/2652
    https://github.com/rudderlabs/rudder-server/pull/2663
    https://github.com/rudderlabs/rudder-server/pull/2664
    https://securitylab.github.com/advisories/GHSL-2022-097_rudder-server/
    http://packetstormsecurity.com/files/173837/Rudder-Server-SQL-Injection-Remote-Code-Execution.html
    https://github.com/rudderlabs/rudder-server/commit/0d061ff2d8c16845179d215bf8012afceba12a30
    https://github.com/rudderlabs/rudder-server/commit/2f956b7eb3d5eb2de3e79d7df2c87405af25071e
    https://github.com/rudderlabs/rudder-server/commit/9c009d9775abc99e72fc470f4c4c8e8f1775e82a
    https://github.com/rudderlabs/rudder-server/pull/2652
    https://github.com/rudderlabs/rudder-server/pull/2663
    https://github.com/rudderlabs/rudder-server/pull/2664
    https://securitylab.github.com/advisories/GHSL-2022-097_rudder-server/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High