by Kastro
Paper/Archive/CVE-2024-3116

CVE-2024-3116

pgadmin.org pgAdmin 4 — Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4

EPSS 66%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.3.993 × 2019.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.

Affected

ProductAffectedFixed inSource
pgAdmin 4< 8.58.5CNA
pgadmin_4< 8.58.5CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
PostgreSQL (CNA)7.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/pgadmin-org/pgadmin4/issues/7326refgist.github.com/aelmokhtar/689a8be7e3bd535ec01992d8ec7b2b98reflists.fedoraproject.org/archives/list/[email protected]/message/GIF5T34JTTYRGIN5YPT366BDFG6452A2refvicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-pgadmin-cve-2024-3116