{"cve":"CVE-2023-23554","nvd":{"published":"2023-03-07T01:15:10.363","modified":"2026-06-17T05:37:25.290","status":"Modified","description":"Uncontrolled search path element vulnerability exists in pg_ivm versions prior to 1.5.1. When refreshing an IMMV, pg_ivm executes functions without specifying schema names. Under certain conditions, pg_ivm may be tricked to execute unexpected functions from other schemas with the IMMV owner's privilege. If this vulnerability is exploited, an unexpected function provided by an attacker may be executed with the privilege of the materialized view owner.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-427"],"references":["https://github.com/sraoss/pg_ivm","https://github.com/sraoss/pg_ivm/releases/tag/v1.5.1","https://jvn.jp/en/jp/JVN19872280/","https://github.com/sraoss/pg_ivm","https://github.com/sraoss/pg_ivm/releases/tag/v1.5.1"],"products":["sraoss:pg_ivm"],"source":"nvd","synced_at":"2026-10-19T21:37:41.955480748+00:00"},"epss":{"cve":"CVE-2023-23554","score":0.00939,"percentile":0.60931,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}