CVE-2024-2044

pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/pgadmin-org/pgadmin4/issues/7258	Issue Tracking Vendor Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/LUYN2JXKKHFSVTASH344TBRGWDH64XQV/	Mailing List
https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/	Exploit Third Party Advisory
https://github.com/pgadmin-org/pgadmin4/issues/7258	Issue Tracking Vendor Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/LUYN2JXKKHFSVTASH344TBRGWDH64XQV/	Mailing List
https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-03-07 21:15

Updated : 2025-09-19 14:55

NVD link : CVE-2024-2044

Mitre link : CVE-2024-2044

CVE.ORG link : CVE-2024-2044

JSON object : View

Products Affected

fedoraproject

fedora

pgadmin

pgadmin_4

CWE

CWE-31

Path Traversal: 'dir\..\..\filename'

{"id": "CVE-2024-2044", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "published": "2024-03-07T21:15:08.767", "references": [{"url": "https://github.com/pgadmin-org/pgadmin4/issues/7258", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/LUYN2JXKKHFSVTASH344TBRGWDH64XQV/", "tags": ["Mailing List"], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}, {"url": "https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/", "tags": ["Exploit", "Third Party Advisory"], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}, {"url": "https://github.com/pgadmin-org/pgadmin4/issues/7258", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/LUYN2JXKKHFSVTASH344TBRGWDH64XQV/", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-31"}]}], "descriptions": [{"lang": "en", "value": "pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users\u2019 sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution."}, {"lang": "es", "value": "pgAdmin 4 utiliza un enfoque de gesti\u00f3n de sesiones basado en archivos. Los archivos de sesi\u00f3n se guardan en el disco como objetos pickle. Cuando un usuario realiza una solicitud, el valor de la cookie de sesi\u00f3n 'pga4_session' se utiliza para recuperar el archivo, luego se deserializa su contenido y finalmente se verifica su firma. El valor de la cookie se divide en 2 partes en el primer '!' personaje. La primera parte es el ID de la sesi\u00f3n (sid), mientras que la segunda es el resumen de la sesi\u00f3n. La vulnerabilidad radica en las versiones de pgAdmin anteriores a la 8.4, donde un m\u00e9todo carga archivos de sesi\u00f3n concatenando la carpeta de sesiones, ubicada dentro de pgAdmin 4 DATA_DIR, con el ID de sesi\u00f3n. Precisamente, los dos valores se concatenan usando la funci\u00f3n ['os.path.join']. No establece una ruta base confiable de la que no se debe escapar"}], "lastModified": "2025-09-19T14:55:20.547", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*", "vulnerable": true, "matchCriteriaId": "D1B23AC3-5F86-4824-9BB4-F5E200A085DD", "versionEndExcluding": "8.4"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA277A6C-83EC-4536-9125-97B84C4FAF59"}], "operator": "OR"}]}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}