PT-2024-2637 · Pgadmin+1 · Pgadmin+1

Ayout Mokhtar · Published 2024-04-04 · Updated 2025-09-29 · CVE-2024-3116

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pgAdmin versions 8.4 and earlier

Description pgAdmin is susceptible to a Remote Code Execution (RCE) vulnerability stemming from improper restriction of the path name to an accessible directory. Successful exploitation allows a remote attacker to execute arbitrary code on the server hosting pgAdmin, potentially compromising the database management system and its underlying data.

Recommendations pgAdmin versions prior to 8.5 are affected. Upgrade to version 8.5 or later to address this issue.

Exploit

Fix

RCE

Command Injection

Path traversal

Weakness Enumeration

CWE-77

CWE-22

Related Identifiers

BDU:2024-02704

CVE-2024-3116

GHSA-27JX-FFW8-XRQV

OPENSUSE-SU-2024:13843-1

Affected Products

Pgadmin

Red Os

References · 31

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/pgadmin_binary_path_api.rb · Exploit
• 🔥 https://github.com/pgadmin-org/pgadmin4/issues/7326 · Exploit
• 🔥 https://github.com/TechieNeurons/CVE-2024-3116_RCE_in_pgadmin_8.4 · Exploit
• 🔥 https://vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-pgadmin-cve-2024-3116 · Exploit
• 🔥 https://gist.github.com/aelmokhtar/689a8be7e3bd535ec01992d8ec7b2b98 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:13843-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-27jx-ffw8-xrqv · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02704 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/GIF5T34JTTYRGIN5YPT366BDFG6452A2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3116 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3116 · Vendor Advisory
• https://github.com/pgadmin-org/pgadmin4 · Note
• https://github.com/pgadmin-org/pgadmin4/commit/fbbbfe22dd468bcfef1e1f833ec32289a6e56a8b · Note
• https://t.me/tmfeed/202294 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-pgadmin4-cve-2024-3116/?sphrase_id=1075903 · Note