CVE-2023-41053CWE-269

Redis SORT_RO may bypass ACL configuration

Low · published September 6, 2023

CVSS v3.1
3.3
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00290 · 20.4th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2023-09-06T20:22Z
EPSS history
Timeline
  • 06 SEP 20:22Z
    Redis SORT_RO may bypass ACL configuration
    cvelistv5