high8.0
CVE-2023-1907
pgAdmin has Incorrect Default Permissions
Impact
A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | pgadmin4 | < 7.0 | 7.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pgadmin | Pgadmin | before 7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/security/cve/CVE-2023-1907
- https://bugzilla.redhat.com/show_bug.cgi?id=2218384
- https://github.com/advisories/GHSA-7w6r-748w-mh52
- https://nvd.nist.gov/vuln/detail/CVE-2023-1907
- https://github.com/pgadmin-org/pgadmin4/issues/6100
- https://github.com/pgadmin-org/pgadmin4/commit/fa29ba91632634d961f937ce3ed2c3b5a9d78f59
- https://github.com/pgadmin-org/pgadmin4/blob/a9974b418c49760d3989b7fb25e052ff16b89ac6/docs/en_US/release_notes_7_0.rst