Lucene search

PostgreSQLVULNRICHMENT:CVE-2024-6238

HistoryJun 25, 2024 - 4:12 p.m.

CVE-2024-6238 pgAdmin 4 Installation Directory permission issue

2024-06-2516:12:12

PostgreSQL

github.com

cve-2024-6238

pgadmin 4

installation directory

permission issue

debian

rhel 8

unauthorized access

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

pgAdmin <= 8.8 has an installation Directory permission issue. Because of this issue, attackers can gain unauthorised access to the installation directory on the Debian or RHEL 8 platforms.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "modules": [
      "Packaging"
    ],
    "product": "pgAdmin 4",
    "programFiles": [
      "https://github.com/pgadmin-org/pgadmin4/blob/master/pkg/debian/build.sh",
      "https://github.com/pgadmin-org/pgadmin4/blob/master/pkg/redhat/build.sh"
    ],
    "repo": "https://github.com/pgadmin-org/pgadmin4",
    "vendor": "pgadmin.org",
    "versions": [
      {
        "lessThan": "8.9",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/pgadmin-org/pgadmin4/issues/7605