Directory Traversal Vulnerability in pgAdmin 4 by pgAdmin Team
CVE-2023-0241

6.5MEDIUM

Key Information:

Vendor
Postgresql
Status
Pgadmin
Vendor
CVE Published:
27 March 2023

Summary

A directory traversal vulnerability found in pgAdmin 4 versions prior to v6.19 allows an attacker to manipulate the file paths used by the application. This vulnerability can potentially enable a user to change another user's settings or modify the database without proper authorization, posing significant security risks. It is crucial for users of pgAdmin 4 to update to the latest version to mitigate these vulnerabilities and protect their data integrity.

Affected Version(s)

pgadmin pgadmin 6.19

References

https://github.com/pgadmin-org/pgadmin4/issues/5734
https://jvn.jp/en/jp/JVN01398015/

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.