CVE-2023-5002

Katalog CVE

CVSS 8.8 · High EPSS 1,8%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada pgadmin 4, fedoraproject fedora. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.

Rincian

Terbit di NVD

22 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pgadmin-org/pgadmin4/issues/6763 issue tracking · patch
• https://bugzilla.redhat.com/show_bug.cgi?id=2239164 issue tracking · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2S24D3S2GVNGTDN... mailing list
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VIRTMQZEE6K7RD3... mailing list