PT-2023-2031 · Pgadmin 4+3 · Pgadmin 4+3

Yuji Tounai · Published 2023-01-13 · Updated 2025-04-17 · CVE-2023-0241

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to v6.19

Description The issue is related to a directory traversal vulnerability in pgAdmin 4. This vulnerability can be exploited by a remote attacker to change another user's settings or alter the database. The vulnerability is associated with insufficient restrictions on the path name to a directory with limited access.

Recommendations For pgAdmin 4 versions prior to v6.19, update to version v6.19 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories and limiting user privileges to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-01743

CVE-2023-0241

GHSA-9CRJ-HPXH-F6QG

OPENSUSE-SU-2024:13667-1

SUSE-SU-2023:1877-1

SUSE-SU-2023_1877-1

Affected Products

Pgadmin

Red Os

Suse

Pgadmin 4

References · 21

• https://github.com/pgadmin-org/pgadmin4/issues/5734 · Patch
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01743 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:1877-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9crj-hpxh-f6qg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0241 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13667-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0241 · Vendor Advisory
• https://suse.com/support/update/announcement/2023/suse-su-20231877-1 · Note
• https://jvn.jp/en/jp/JVN01398015 · Note
• https://t.me/cvenotify/115056 · Telegram Post
• https://github.com/akshay-joshi/pgadmin4/commit/f59d93a2f37cd4bea7878d59e212647ca6152fed · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-pgadmin4-cve-2022-4223-cve-2024-4215-cve-2023-0241-cve-2024-4216 · Note
• https://bugzilla.suse.com/1207464 · Note
• https://suse.com/security/cve/CVE-2022-0959 · Note