CVE-2023-41053

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by SORT_RO and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Software

Name	Vendor	Start Version	End Version
Redis	Redis	7.0 (including)	7.0.13 (excluding)
Redis	Redis	7.2.0 (including)	7.2.0 (including)
Redis	Redis	7.2.0-rc1 (including)	7.2.0-rc1 (including)
Redis	Redis	7.2.0-rc2 (including)	7.2.0-rc2 (including)
Redis	Redis	7.2.0-rc3 (including)	7.2.0-rc3 (including)
Red Hat Enterprise Linux 9	RedHat	redis:7-9050020241104103753.9	*
Redis	Ubuntu	lunar	*
Redis	Ubuntu	mantic	*
Redis	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-41053
CWE	https://cwe.mitre.org/data/definitions/269.html

Improper Privilege Management

Weakness

Affected Software

Potential Mitigations

References

CVE-2023-41053

Improper Privilege Management

Weakness

Affected Software

Potential Mitigations

Related Attack Patterns

References