CVE-2023-31131 is a critical path traversal vulnerability affecting Greenplum Database (GPDB) versions prior to 6.22.3, stemming from unsafe tar file extraction within GPPKGs. This flaw allows an unauthenticated attacker to perform arbitrary file writes, potentially overwriting system files and causing system crashes or malfunction. With a CVSS score of 9.1 (CRITICAL), it presents a high risk due to its network-based attack vector and low attack complexity, leading to high integrity and availability impacts. There is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV entry, but it has garnered significant community discussion with 10 mentions.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 6.22.3CPE matchmatch criteria | cpe:2.3:a:vmware:greenplum_database:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.