pgadmin4@6.17 vulnerabilities

pgadmin4 is a PostgreSQL Tools

Affected versions of this package are vulnerable to Arbitrary Command Injection via the backup and restore processes when handling file path input with shell execution enabled. An attacker can execute arbitrary system commands by supplying specially crafted file paths.

Upgrade pgadmin4 to version 9.10 or higher.

pgadmin4 is a PostgreSQL Tools

Affected versions of this package are vulnerable to Arbitrary Code Injection through the PLAIN SQL file, which includes any meta-commands. An attacker can execute arbitrary commands on the server by supplying a crafted PLAIN-format SQL dump file during restoration in server mode.

Upgrade pgadmin4 to version 9.10 or higher.

pgadmin4 is a PostgreSQL Tools

Affected versions of this package are vulnerable to Improper Certificate Validation via the TLS certificate verification bypass. An attacker can gain unauthorized access by exploiting improper TLS certificate verification during authentication.

Upgrade pgadmin4 to version 9.10 or higher.

pgadmin4 is a PostgreSQL Tools

Affected versions of this package are vulnerable to Denial of Service (DoS) via the username from the login form which inserted into the LDAP search filter without escaping. An attacker can cause the server and client to process excessive data by injecting special LDAP characters in the username, leading to resource exhaustion.

Upgrade pgadmin4 to version 9.10 or higher.

pgadmin4 is a PostgreSQL Tools

Affected versions of this package are vulnerable to Origin Validation Error via improper enforcement of cross-origin opener policy in the OAuth authentication process. An attacker can gain unauthorized access to user accounts, escalate privileges, or exfiltrate sensitive data by manipulating the OAuth flow.

Upgrade pgadmin4 to version 9.8 or higher.

pgadmin4 is a PostgreSQL Tools

Affected versions of this package are vulnerable to Remote Code Execution (RCE) in the Cloud Deployment with Google Provider module, which is accessible via the high_availability parameter to the /deploy endpoint and in the Query Tool interface, which is accessible via the query_commited parameter to the /download endpoint. An attacker can execute arbitrary commands with the privileges of the application user.

Upgrade pgadmin4 to version 9.2 or higher.

pgadmin4 is a PostgreSQL Tools

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the measureText() function, accessible via the Query Tool interface. An attacker can inject malicious scripts into the displayed output.

Upgrade pgadmin4 to version 9.2 or higher.

pgadmin4 is a PostgreSQL Tools

Affected versions of this package are vulnerable to Race Condition during the LDAP authentication process. An attacker can hijack another user's session by initiating multiple simultaneous login attempts.

Upgrade pgadmin4 to version 7.0 or higher.

pgadmin4 is a PostgreSQL Tools

Affected versions of this package are vulnerable to Information Exposure due to improper handling of OAuth2 authentication credentials.

Upgrade pgadmin4 to version 8.12 or higher.

pgadmin4 is a PostgreSQL Tools

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the /settings/store API response json payload. An attacker can execute malicious script at the client end by injecting script content into the json response.

Upgrade pgadmin4 to version 8.6 or higher.

pgadmin4 is a PostgreSQL Tools

Affected versions of this package are vulnerable to Authentication Bypass due to a flaw in the multi-factor authentication process. An attacker with knowledge of a legitimate account's username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account's MFA enrollment status.

Upgrade pgadmin4 to version 8.6 or higher.

pgadmin4 is a PostgreSQL Tools

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') via the validate binary path API. An attacker can execute arbitrary code on the server hosting the application, posing a severe risk to the integrity of the database management system and the security of the underlying data.

Upgrade pgadmin4 to version 8.5 or higher.

pgadmin4 is a PostgreSQL Tools

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the use of a file-based session management approach where session files are saved on disk as pickle objects. An attacker can execute arbitrary code on the system by manipulating the session ID to escape the intended session folder path and point to a maliciously crafted file.

Upgrade pgadmin4 to version 8.4 or higher.

pgadmin4 is a PostgreSQL Tools

Affected versions of this package are vulnerable to Command Injection when the HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. A user can run arbitrary commands on the server by passing commands as filenames.

NOTE: This issue does not affect pgAdmin's desktop mode.

Upgrade pgadmin4 to version 7.7 or higher.