3.3

CVE-2023-41053: redis Improper Privilege Management

CVSS: 3.3v3.1LowModified
AliasesALPINE-CVE-2023-41053SUSE-SU-2023:3711-1UBUNTU-CVE-2023-41053
Published 06-09-2023Last modified 13-02-2025
Open JSON

Vulnerability summary

CVE-2023-41053 is a low (CVSS 3.3) Improper Privilege Management vulnerability in redis. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.2% of scored vulnerabilities.

Overall risk
13/100
0100
Low · default modelHow is this calculated?
CVSS score
3.3/10
010
Low · v3.1 (CVE.org)
EPSS score
0.29%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 3
DSA-5610-1OPENSUSE-SU-2024:13354-1RHSA-2024:10869CGA-9PFH-3FQR-FG4VCGA-R49G-H476-JCX6

Timeline

  1. 06-09-2023
    PublishedVulnerability first disclosed.
  2. 13-02-2025
    Last modifiedVulnerability information updated.

Description

Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.29%

Chance of exploitation in the next 30 days

Percentile

20%

Versus all other CVEs

30-day change

0.00 pp

From 0.29% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.29%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Alpine1 product
  • redis≥ 7.0, < 7.0.13-r0 | ≥ 7.0, < 7.2.1-r0
Debian1 product
  • redis< 5:7.0.15-1~deb12u1 | < 5:7.0.13-1
Opensuse1 product
  • redis7&distro=openSUSE Leap 15.5< 7.0.8-150500.3.6.1
Redis1 product
  • redis≥ 7.0.0, < 7.0.13 | ≥ 7.1.0, < 7.2.1 | ≥ 7.0, < 7.0.13 | 7.2.0 | 7.2.0:rc1 | 7.2.0:rc2 | 7.2.0:rc3
Suse1 product
  • redis7&distro=SUSE Linux Enterprise Module for Server Applications 15 SP5< 7.0.8-150500.3.6.1
Ubuntu1 product
  • redis< 5:7.0.14-1

6 vendors · 6 products

References

12 links
Show all 12 references