CVE-2023-31043 Information disclosure in n/a

High 7.5 Published 23 Apr 2023 Updated 4 Feb 2025

Attackers can read unredacted passwords from logs when specific optional parameters are used in user management commands despite redaction settings.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-31043?

CVE-2023-31043 is a high-severity vulnerability in n/a, published on 23 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USER/GROUP/ROLE, and redacting was configured with edb_filter_log.redact_password_commands. The fixed versions are 10.23.33, 11.18.29, 12.13.17, 13.9.13, and 14.6.0.

Weakness: CWE-312, CWE-521

Which versions are affected by CVE-2023-31043?

It affects 1 product.

Products include Enterprisedb Postgres Advanced Server.

How do I fix CVE-2023-31043?

No fix has been published for CVE-2023-31043 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-31043 being exploited?

There is no known exploitation of CVE-2023-31043 in the wild and no public exploit code.

Sources

Also known as GHSA-8wm5-mg2w-7cq3.