{"id":"CVE-2023-5002","published":"2023-09-22T13:31:43Z","modified":"2024-08-02T07:44:53Z","title":"Pgadmin4: remote code execution by an authenticated user","vendor":null,"product":null,"tier":"tail","description":{"text":"A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.","provenance":"source","from":"CVE.org"},"cvss":{"score":6,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01784,"percentile":0.78211,"provenance":"source"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239164","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/pgadmin-org/pgadmin4/issues/6763","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2S24D3S2GVNGTDNE6SF2OQSOPU3H72UW/","tags":[]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VIRTMQZEE6K7RD37ERZ2UFYFLEUXLQU3/","tags":[]}],"priority":{"score":19.8,"factors":[{"name":"EPSS percentile","points":15.64},{"name":"CVSS severity","points":4.2}]},"affected":[{"ecosystem":"PyPI","package":"pgadmin4","vulnerableRanges":["<7.7"],"patched":["7.7"],"from":["GHSA-ghp8-52vx-77j4","PYSEC-2026-1774"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-2508","exploited":false,"provenance":"source"}}