A logged-in database user having the system privilege CREATE SCRIPT or CREATE ANY SCRIPT could possibly escape the sandboxed UDF execution and gain access to the host machine running the database.
- User has login access to the database (valid credentials and CREATE SESSION system privilege).
- User has at least one of the system privileges CREATE SCRIPT and CREATE ANY SCRIPT.
We recommend to review already granted system privileges CREATE SCRIPT and CREATE ANY SCRIPT and reduce them only to a necessary level.
The vulnerability was fixed and users are advised to update to Exasol 6.2.15, 7.0.10, or 7.1.0.