← Back

CVE-2024-2044

nvd nist
Published: Mar 7, 2024Modified: Jun 17, 2026

JSON object

Loading...
9.9
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploitability: 3.1 / Impact: 6.0
Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 (Secondary)

Description

pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.

Affected (2)

Pgadmin
1 product
Pgadmin 4
Fedoraproject
1 product
Fedora
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Pgadmin 4
Before 8.4
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Fedora
Version 40

Related CWEs

CWE-31
Path Traversal: 'dir\..\..\filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize 'dir\..\..\filename' (multiple internal backslash dot dot) sequences that can resolve to a location that is outside of that directory.

References (6)

Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
Issue TrackingVendor Advisory
Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
Mailing List
Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory

Timeline

No history available yet.