A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user
    selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6
    failed to properly control the server code executed on this API, allowing an authenticated user to run
    arbitrary commands on the server. (CVE-2023-5002)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-478aa17fa2 advisory.

    Backport fix for CVE-2023-5002.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-8cc61c8b14 advisory.

    Backport fix for CVE-2023-5002.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
415150	SCA: security update for pgadmin4 (GHSA-ghp8-52vx-77j4)	Tenable Cloud Security	SCA Checks	high
415150	SCA: security update for pgadmin4 (GHSA-ghp8-52vx-77j4)	Tenable Self-Hosted Container Security	SCA Checks	high
182548	Fedora 37 : pgadmin4 (2023-478aa17fa2)	Nessus	Fedora Local Security Checks	high
182541	Fedora 38 : pgadmin4 (2023-8cc61c8b14)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2023-5002

high

Tenable Plugins

high

high

high

high