Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-GHP8-52VX-77J4
HistorySep 22, 2023 - 3:30 p.m.

pgAdmin failed to properly control the server code

2023-09-2215:30:15
GitHub Advisory Database
github.com
12
pgadmin
server code
http api
postgresql utilities
pg_dump
pg_restore
authenticated user

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

28.0%

JSON

A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.7 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.

Affected configurations

Vulners
Node
pgadmin4Range<7.7

Related

nvd 1
openvas 2
redos 1
fedora 2
veracode 1
nessus 2
vulnrichment 1
osv 2
prion 1
cvelist 1
cve 1
nvd
nvd
CVE-2023-5002
2023-09-22 14:15:47
openvas
openvas
Fedora: Security Advisory for pgadmin4 (FEDORA-2023-8cc61c8b14)
2023-10-05 00:00:00
Fedora: Security Advisory for pgadmin4 (FEDORA-2023-478aa17fa2)
2023-10-05 00:00:00
redos
redos
ROS-20231011-01
2023-10-11 00:00:00
fedora
fedora
[SECURITY] Fedora 38 Update: pgadmin4-6.21-3.fc38
2023-10-04 15:51:41
[SECURITY] Fedora 37 Update: pgadmin4-6.19-2.fc37
2023-10-04 15:49:03
veracode
veracode
Remote Code Execution
2023-09-27 08:51:31
nessus
nessus
Fedora 38 : pgadmin4 (2023-8cc61c8b14)
2023-10-04 00:00:00
Fedora 37 : pgadmin4 (2023-478aa17fa2)
2023-10-04 00:00:00
vulnrichment
vulnrichment
CVE-2023-5002 Pgadmin4: remote code execution by an authenticated user
2023-09-22 13:31:43
osv
osv
pgAdmin failed to properly control the server code
2023-09-22 15:30:15
CVE-2023-5002
2023-09-22 14:15:47
prion
prion
Design/Logic Flaw
2023-09-22 14:15:00
cvelist
cvelist
CVE-2023-5002 Pgadmin4: remote code execution by an authenticated user
2023-09-22 13:31:43
cve
cve
CVE-2023-5002
2023-09-22 14:15:47

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

28.0%

JSON
Related for GHSA-GHP8-52VX-77J4
nvd1openvas2redos1fedora2veracode1nessus2vulnrichment1osv2prion1cvelist1cve1