CVE-2024-3116

Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4

Severity Score

7.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.

pgAdmin <= 8.4 se ve afectado por una vulnerabilidad de ejecución remota de código (RCE) a través de la API de validación de ruta binaria. Esta vulnerabilidad permite a los atacantes ejecutar código arbitrario en el servidor que aloja PGAdmin, lo que representa un grave riesgo para la integridad del sistema de gestión de la base de datos y la seguridad de los datos subyacentes.

pgAdmin versions 8.4 and below are affected by a remote code execution vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.

*Credits: N/A

CVSS Scores

PostgreSQLv3.1 7.4

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

Poc

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2024-03-30 CVE Reserved
2024-04-04 CVE Published
2024-04-11 First Exploit
2024-08-21 CVE Updated
2024-08-29 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CAPEC

References (4)

URL	Tag	Source
https://gist.github.com/aelmokhtar/689a8be7e3bd535ec01992d8ec7b2b98	Mitigation
https://github.com/pgadmin-org/pgadmin4/issues/7326	Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIF5T34JTTYRGIN5YPT366BDFG6452A2

URL	Date	SRC
https://github.com/TechieNeurons/CVE-2024-3116_RCE_in_pgadmin_8.4	2024-04-11

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Pgadmin.org Search vendor "Pgadmin.org"		PgAdmin 4 Search vendor "Pgadmin.org" for product "PgAdmin 4"				< 8.5 Search vendor "Pgadmin.org" for product "PgAdmin 4" and version " < 8.5"		en		Affected