Path Traversal

2024-03-0809:07:31

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

pgadmin4

path traversal

insufficient input validation

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

0.002

Percentile

53.0%

JSON

pgadmin4 is vulnerable to Path Traversal. The vulnerability is due to Insufficient Input Validation due to concatenating the sessions directory path with the session ID using the os.path.join function, without setting a trusted base path, allowing an attacker to manipulate the session ID and traverse to unintended directories on the server.