CVE-2023-5002: Pgadmin4: remote code execution by an authenticated user
Vulnerability summary
CVE-2023-5002 is a high (CVSS 8.8) vulnerability in fedoraproject fedora. EPSS estimates a 1.78% chance of exploitation in the next 30 days, higher than 78.3% of scored vulnerabilities.
Not severe (CVSS 6, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 22-09-2023PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA6.0MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:HDiffers
- OSV · PypiEcosystem advisory · calculated6.0MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:HDiffers
EPSS trend
Probability
1.78%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.78% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, administrative account, user interaction (CVSS vector). Other conditions: not stated in public data.
Fedoraproject1 product
- fedoraEOL37 | 38
Opensuse1 product
- pgadmin4&distro=openSUSE Tumbleweed< 7.8-1.1
Pgadmin1 product
- pgadmin_4< 7.7
PyPI1 product
- pgadmin4< 7.7
4 vendors · 4 products
References
12 links- lists.fedoraproject.org/archives/…Mailing List
- lists.fedoraproject.org/archives/…Mailing List
- pypi.org/project/pgadmin4PACKAGE