HIGH
Pgadmin4: remote code execution by an authenticated user
Published Sep 22, 2023
8.8
HIGHCVSS 3.1
EPSS 1.78%
Description
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.
Affected products
No data.
Configuration 2
OR
- 37
- 38
-
- Version 0StatusaffectedConstraints<7.6
- Version
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (8)
- https://bugzilla.redhat.com/show_bug.cgi?id=2239164 issue-trackingx_refsource_REDHATIssue TrackingThird Party Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2508 Advisory
- https://github.com/advisories/GHSA-ghp8-52vx-77j4 Advisory
- https://github.com/pgadmin-org/pgadmin4/commit/35f05e49b3632a0a674b9b36535a7fe2d93dd0c2
- https://github.com/pgadmin-org/pgadmin4/issues/6763 Issue TrackingPatch
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2S24D3S2GVNGTDNE6SF2OQSOPU3H72UW Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VIRTMQZEE6K7RD37ERZ2UFYFLEUXLQU3 Mailing List
- https://nvd.nist.gov/vuln/detail/CVE-2023-5002
| Link | Providers | Tags |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2239164 | issue-trackingx_refsource_REDHATIssue TrackingThird Party Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2508 | Advisory | |
| https://github.com/advisories/GHSA-ghp8-52vx-77j4 | Advisory | |
| https://github.com/pgadmin-org/pgadmin4/commit/35f05e49b3632a0a674b9b36535a7fe2d93dd0c2 | ||
| https://github.com/pgadmin-org/pgadmin4/issues/6763 | Issue TrackingPatch | |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2S24D3S2GVNGTDNE6SF2OQSOPU3H72UW | Mailing List | |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VIRTMQZEE6K7RD37ERZ2UFYFLEUXLQU3 | Mailing List | |
| https://nvd.nist.gov/vuln/detail/CVE-2023-5002 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner fedora
Published Sep 22, 2023
Updated Aug 2, 2024
Reserved Sep 15, 2023
Link CVE-2023-5002
CISA Vulnrichment
Updated May 14, 2024
ENISA EUVD
EUVD-2023-2508 GHSA-GHP8-52VX-77J4 Assigner fedora
Published Sep 22, 2023
Updated Aug 2, 2024
Exploited since n/a
Link EUVD-2023-2508