{"id":"CVE-2023-0241","published":"2023-03-27T00:00:00Z","modified":"2025-02-19T16:09:17Z","title":"pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability","vendor":null,"product":null,"tier":"tail","description":{"text":"pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.08826,"percentile":0.95173,"provenance":"source"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/5734","tags":[]},{"url":"https://jvn.jp/en/jp/JVN01398015/","tags":[]}],"priority":{"score":19.0,"factors":[{"name":"EPSS percentile","points":19.03}]},"affectedVersions":[{"vendor":"n/a","product":"pgadmin","versions":["pgadmin 6.19"]}],"affected":[{"ecosystem":"PyPI","package":"pgadmin4","vulnerableRanges":["<6.19"],"patched":["6.19"],"from":["GHSA-9crj-hpxh-f6qg","PYSEC-2026-1771"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0964","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-0959","published":"2022-03-16","fixed":"6.7","kev":false},{"cve":"CVE-2023-22298","published":"2023-01-17","fixed":"6.14","kev":false},{"cve":"CVE-2022-4223","published":"2022-12-13","fixed":"6.17","kev":false,"link":{"from":"CVE-2022-4223","to":"CVE-2023-0241","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:pgadmin4","fromFixed":"6.17","toFixed":"6.19","daysApart":104}]}},{"cve":"CVE-2023-0241","published":"2023-03-27","fixed":"6.19","kev":false},{"cve":"CVE-2023-1907","published":"2025-01-09","fixed":"7.0","kev":false},{"cve":"CVE-2023-5002","published":"2023-09-22","fixed":"7.7","kev":false},{"cve":"CVE-2024-3116","published":"2024-04-04","fixed":"8.5","kev":false}],"package":"PyPI:pgadmin4"}}