PT-2023-5414 · Pgadmin+1 · Pgadmin+1

Stefan Grönke · Published 2023-09-22 · Updated 2025-03-17 · CVE-2023-5002

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pgAdmin versions prior to 7.7

Description The issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg dump and pg restore. This allows an authenticated user to run arbitrary commands on the server due to insufficient input validation. Approximately 5,294 results are affected, according to ZoomEyeDork.

Recommendations For pgAdmin versions prior to 7.7, update to version 7.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the pgAdmin server HTTP API to minimize the risk of exploitation. Avoid using the API endpoint that validates the path to external PostgreSQL utilities until the issue is resolved.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-20

CWE-78

Related Identifiers

BDU:2023-06044

CVE-2023-5002

GHSA-GHP8-52VX-77J4

OPENSUSE-SU-2024:13379-1

Affected Products

Pgadmin

Red Os

References · 25

• https://github.com/pgadmin-org/pgadmin4/issues/6763 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VIRTMQZEE6K7RD37ERZ2UFYFLEUXLQU3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5002 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2S24D3S2GVNGTDNE6SF2OQSOPU3H72UW · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13379-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5002 · Security Note
• https://osv.dev/vulnerability/GHSA-ghp8-52vx-77j4 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06044 · Security Note
• https://github.com/pgadmin-org/pgadmin4 · Note
• https://github.com/pgadmin-org/pgadmin4/commit/35f05e49b3632a0a674b9b36535a7fe2d93dd0c2 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-pgadmin-cve-2023-5002 · Note
• https://suse.com/security/cve/CVE-2023-5002 · Note
• https://t.me/pentestingnews/39694 · Telegram Post
• https://t.me/cvenotify/58428 · Telegram Post
• https://twitter.com/CybachOy/status/1707081529493533017 · Twitter Post