CVE-2024-2044

Katalog CVE

CVSS 9.9 · Critical EPSS 79,5%

Kerentanan Path Traversal: 'dir\..\..\filename' pada pgadmin 4, fedoraproject fedora. Skor CVSS 3.1 9.9 (Critical) menurut CNA.

Deskripsi (NVD)

pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.

Rincian

Terbit di NVD

7 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-31: Path Traversal: 'dir\..\..\filename'

EPSS (30 hari)

79,5% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pgadmin-org/pgadmin4/issues/7258 issue tracking · advisory vendor
• https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/ exploit · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LUYN2JXKKHFSVTA... mailing list