{"id":"CVE-2022-4223","published":"2022-12-13T00:00:00Z","modified":"2025-04-14T18:12:15Z","title":"The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external…","vendor":null,"product":null,"tier":"core","eol":null,"affectedVersions":[{"vendor":"n/a","product":"pgadmin4","versions":["pgadmin4 6.17"]}],"description":{"text":"The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server.","provenance":"source","from":"CVE.org"},"summary":{"text":"The pgAdmin server's HTTP API for validating paths to external PostgreSQL utilities such as pg_dump and pg_restore, which the server executes to determine the PostgreSQL version, failed to properly restrict access in versions prior to 6.17. An attacker who can reach the API without authentication and get a user to interact with the request can supply a path of their choosing, such as a UNC path to a server they control on Windows, causing an executable with a matching name in that location to run on the pgAdmin server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:51Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.80069,"percentile":0.99614,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/5593","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5EYTPKHVFSDCETBJI7LBZE4EYHBPN2Q/","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"pgadmin4","vulnerableRanges":["<6.17"],"patched":["6.17"],"from":["GHSA-3v6v-2x6p-32mc","PYSEC-2026-893"],"provenance":"source"}],"advisories":[{"id":"GHSA-3v6v-2x6p-32mc","url":"https://github.com/advisories/GHSA-3v6v-2x6p-32mc","severity":"HIGH","ecosystem":"PyPI","package":"pgadmin4","vulnerableRanges":["<6.17"],"patched":["6.17"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-7489","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7489","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2022-4223","name":"pgAdmin < 6.17 - Unauthenticated Remote Code Execution","severity":"critical","path":"http/cves/2022/CVE-2022-4223.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-4223.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-12-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-4223","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":31.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9961"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2022-0959","published":"2022-03-16","fixed":"6.7","kev":false},{"cve":"CVE-2023-22298","published":"2023-01-17","fixed":"6.14","kev":false},{"cve":"CVE-2022-4223","published":"2022-12-13","fixed":"6.17","kev":false},{"cve":"CVE-2023-0241","published":"2023-03-27","fixed":"6.19","kev":false,"link":{"from":"CVE-2022-4223","to":"CVE-2023-0241","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:pgadmin4","fromFixed":"6.17","toFixed":"6.19","daysApart":104}]}},{"cve":"CVE-2023-1907","published":"2025-01-09","fixed":"7.0","kev":false},{"cve":"CVE-2023-5002","published":"2023-09-22","fixed":"7.7","kev":false}],"package":"PyPI:pgadmin4"}}