A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2239164 | Issue Tracking Third Party Advisory |
| https://github.com/pgadmin-org/pgadmin4/issues/6763 | Issue Tracking Patch |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2S24D3S2GVNGTDNE6SF2OQSOPU3H72UW/ | Mailing List |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VIRTMQZEE6K7RD37ERZ2UFYFLEUXLQU3/ | Mailing List |
| https://bugzilla.redhat.com/show_bug.cgi?id=2239164 | Issue Tracking Third Party Advisory |
| https://github.com/pgadmin-org/pgadmin4/issues/6763 | Issue Tracking Patch |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2S24D3S2GVNGTDNE6SF2OQSOPU3H72UW/ | Mailing List |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VIRTMQZEE6K7RD37ERZ2UFYFLEUXLQU3/ | Mailing List |
Configurations
History
21 Nov 2024, 08:40
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2239164 - Issue Tracking, Third Party Advisory | |
| References | () https://github.com/pgadmin-org/pgadmin4/issues/6763 - Issue Tracking, Patch | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2S24D3S2GVNGTDNE6SF2OQSOPU3H72UW/ - Mailing List | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VIRTMQZEE6K7RD37ERZ2UFYFLEUXLQU3/ - Mailing List | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.0 |
26 Oct 2023, 17:59
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Fedoraproject fedora
Fedoraproject |
|
| References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2S24D3S2GVNGTDNE6SF2OQSOPU3H72UW/ - Mailing List | |
| References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VIRTMQZEE6K7RD37ERZ2UFYFLEUXLQU3/ - Mailing List | |
| CPE | cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
04 Oct 2023, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Sep 2023, 18:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/pgadmin-org/pgadmin4/issues/6763 - Issue Tracking, Patch | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2239164 - Issue Tracking, Third Party Advisory | |
| CPE | cpe:2.3:a:pgadmin:pgadmin:*:*:*:*:*:postgresql:*:* | |
| CWE | NVD-CWE-noinfo | |
| First Time |
Pgadmin
Pgadmin pgadmin |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
22 Sep 2023, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-22 14:15
Updated : 2024-11-21 08:40
NVD link : CVE-2023-5002
Mitre link : CVE-2023-5002
CVE.ORG link : CVE-2023-5002
JSON object : View
Products Affected
pgadmin
- pgadmin
fedoraproject
- fedora
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
NVD-CWE-noinfo