File-based session management vulnerability in pgAdmin 4

CVE-2024-2044

What is CVE-2024-2044?

pgAdmin versions up to 8.3 are vulnerable to a path traversal flaw that manifests during the deserialization of user sessions in the session handling code. On Windows servers, this vulnerability allows unauthenticated attackers to remotely load and deserialize malicious pickle objects, leading to potential code execution. In contrast, if the server operates on a POSIX/Linux platform, authenticated users can exploit the vulnerability by uploading and deserializing these objects, which can similarly result in code execution. Organizations using affected versions of pgAdmin should implement immediate mitigations to safeguard their systems.

References