CVE-2023-5002 Pgadmin4: remote code execution by an authenticated user

2023-09-2213:31:43

CWE-78

fedora

github.com

cve-2023-5002

pgadmin4

remote code execution

authenticated user

http api

postgresql utilities

pg_dump

pg_restore

arbitrary commands

server code control

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

28.0%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:pgadmin:pgadmin:-:*:*:*:*:postgresql:*:*"
    ],
    "vendor": "pgadmin",
    "product": "pgadmin",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "7.6",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]