High severity · published Mar 8, 2024
CVE-2024-2338
SQL Injection in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
PostgreSQL Anonymizer v1.2 contains a SQL injection vulnerability that allows a user who owns a table to elevate to superuser when dynamic masking is enabled. PostgreSQL Anonymizer enables users to set security labels on tables to mask specified columns. There is a flaw that allows complex expressions to be provided as a value. This expression is then later used as it to create the masked views leading to SQL Injection. If dynamic masking is enabled, this will lead to privilege escalation to superuser after the label is created. Users that don't own a table, especially masked users cannot exploit this vulnerability. The problem is resolved in v1.3.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
PostgreSQL Anonymizer · DALIBO
1 before 1.3.0 · source: vendor, CISA
AN
Anonymizer · Dalibo
1.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-2338
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-2338
Patch
https://gitlab.com/dalibo/postgresql_anonymizer/-/commit/f55daadba3fa8226029687964aa8889d01a79778
More from PostgreSQL Anonymizer
8.8
CVE-2026-19633
PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries
8.8
CVE-2026-9617
PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() function
8.8
CVE-2024-2339
Improper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule
8.0
CVE-2026-2361
Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user with create privilege to gain superuser privileges
8.0
CVE-2026-2360
Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14