{"id":"CVE-2023-22298","published":"2023-01-17T00:00:00Z","modified":"2025-04-03T15:12:12Z","title":"Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect…","vendor":"pgAdmin Project","product":"pgAdmin 4","tier":"tail","description":{"text":"Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.0096,"percentile":0.61423,"provenance":"source"},"cwes":[{"id":"CWE-601","name":"URL Redirection to Untrusted Site"}],"references":[{"url":"https://www.pgadmin.org/","tags":[]},{"url":"https://github.com/pgadmin-org/pgadmin4","tags":[]},{"url":"https://github.com/pgadmin-org/pgadmin4/issues/5343","tags":[]},{"url":"https://jvn.jp/en/jp/JVN03832974/index.html","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHY2B25YHIIFQ3G44TR7NNEST7FJGJPH/","tags":["vendor-advisory"]}],"priority":{"score":16.6,"factors":[{"name":"EPSS percentile","points":12.28},{"name":"CVSS severity","points":4.27}]},"vendorSlug":"pgadmin-project","affectedVersions":[{"vendor":"pgAdmin Project","product":"pgAdmin 4","versions":["versions prior to v6.14"]}],"affected":[{"ecosystem":"PyPI","package":"pgadmin4","vulnerableRanges":["<6.14"],"patched":["6.14"],"from":["GHSA-894c-rg7f-3c62","PYSEC-2026-894"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-0402","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-0959","published":"2022-03-16","fixed":"6.7","kev":false,"link":{"from":"CVE-2022-0959","to":"CVE-2023-22298","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:pgadmin4","fromFixed":"6.7","toFixed":"6.14","daysApart":307}]}},{"cve":"CVE-2023-22298","published":"2023-01-17","fixed":"6.14","kev":false},{"cve":"CVE-2022-4223","published":"2022-12-13","fixed":"6.17","kev":false},{"cve":"CVE-2023-0241","published":"2023-03-27","fixed":"6.19","kev":false},{"cve":"CVE-2023-1907","published":"2025-01-09","fixed":"7.0","kev":false}],"package":"PyPI:pgadmin4"}}