Every CVE Search/ Get API key

CVE-2023-39593

Insecure permissions in the sys_exec function of Oracle MYSQL MariaDB v10.5 allows authenticated...

5.6 MediumPublic exploitDisputed

Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
Low

Exploit likelihood

0.73%Up 0.7 points since Oct 18, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.6

Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.

Record
CVE-2023-39593
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2023-43302 5.6

Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.

Record
EUVD-2023-43302
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-xr59-q2m8-w439 5.6

Insecure permissions in the sys_exec function of Oracle MYSQL MariaDB v10.5 allows authenticated...

Insecure permissions in the sys_exec function of Oracle MYSQL MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges.

Record
GHSA-xr59-q2m8-w439
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-94
Updated
2026-11-02
NVD 5.6

Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.

Record
CVE-2023-39593
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-94
Updated
2026-11-02
OSV 5.6

Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.

Record
CVE-2023-39593
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2023-39593 5.6

Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.

Record
UBUNTU-CVE-2023-39593
CVSS 3.1
5.6 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVBIT-mariadb-2023-39593 No score

Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.

Record
BIT-mariadb-2023-39593
Updated
2026-11-02
OSVBIT-mariadb-min-2023-39593 No score

Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.

Record
BIT-mariadb-min-2023-39593
Updated
2026-11-02
OSVBIT-mysql-client-2023-39593 No score

Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed.

Record
BIT-mysql-client-2023-39593
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mariadb
Bitnami
 10.5.0 to 10.5.0 None known
mariadb-min
Bitnami
 10.5.0 to 10.5.0 None known
mysql-client
Bitnami
 10.5.0 to 10.5.0 None known
mysql-5.5
Ubuntu:14.04:LTS
 All versions, plus listed versions
5.5.32-0ubuntu75.5.34-0ubuntu15.5.34-0ubuntu25.5.35-0ubuntu15.5.35+dfsg-1ubuntu1
Show 20 moreShow less
5.5.37-0ubuntu0.14.04.15.5.38-0ubuntu0.14.04.15.5.40-0ubuntu0.14.04.15.5.41-0ubuntu0.14.04.15.5.43-0ubuntu0.14.04.15.5.44-0ubuntu0.14.04.15.5.46-0ubuntu0.14.04.25.5.47-0ubuntu0.14.04.15.5.49-0ubuntu0.14.04.15.5.50-0ubuntu0.14.04.15.5.52-0ubuntu0.14.04.15.5.53-0ubuntu0.14.04.15.5.54-0ubuntu0.14.04.15.5.55-0ubuntu0.14.04.15.5.57-0ubuntu0.14.04.15.5.58-0ubuntu0.14.04.15.5.59-0ubuntu0.14.04.15.5.60-0ubuntu0.14.04.15.5.61-0ubuntu0.14.04.15.5.62-0ubuntu0.14.04.1
 None known
mysql-5.7
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
5.7.11-0ubuntu45.7.11-0ubuntu55.7.11-0ubuntu65.7.12-0ubuntu15.7.12-0ubuntu1.1
Show 31 moreShow less
5.7.13-0ubuntu0.16.04.25.7.15-0ubuntu0.16.04.15.7.16-0ubuntu0.16.04.15.7.17-0ubuntu0.16.04.15.7.17-0ubuntu0.16.04.25.7.18-0ubuntu0.16.04.15.7.19-0ubuntu0.16.04.15.7.20-0ubuntu0.16.04.15.7.21-0ubuntu0.16.04.15.7.22-0ubuntu0.16.04.15.7.23-0ubuntu0.16.04.15.7.24-0ubuntu0.16.04.15.7.25-0ubuntu0.16.04.25.7.26-0ubuntu0.16.04.15.7.27-0ubuntu0.16.04.15.7.28-0ubuntu0.16.04.25.7.29-0ubuntu0.16.04.15.7.30-0ubuntu0.16.04.15.7.31-0ubuntu0.16.04.15.7.32-0ubuntu0.16.04.15.7.33-0ubuntu0.16.04.15.7.35-0ubuntu0.16.04.1+esm15.7.36-0ubuntu0.16.04.1+esm15.7.37-0ubuntu0.16.04.1+esm15.7.38-0ubuntu0.16.04.1+esm15.7.39-0ubuntu0.16.04.1+esm25.7.40-0ubuntu0.16.04.1+esm15.7.41-0ubuntu0.16.04.1+esm15.7.42-0ubuntu0.16.04.1+esm15.7.43-0ubuntu0.16.04.1+esm15.7.44-0ubuntu0.16.04.1+esm1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubAnt1sec-ops/CVE-2023-395932022-06-19

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-39593 is a medium vulnerability (CVSS 5.6) in Mariadb, published October 17, 2024. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open