← Back to CVEs

CVE-2024-2044

CRITICAL

9.9

Description

pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.

CVE Details

CVSS v3.1 Score9.9

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published3/7/2024

Last Modified9/19/2025

Sourcenvd

Honeypot Sightings0

Affected Products

fedoraproject:fedorapgadmin:pgadmin_4

Weaknesses (CWE)

CWE-31

References

https://github.com/pgadmin-org/pgadmin4/issues/7258(f86ef6dc-4d3a-42ad-8f28-e6d5547a5007)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LUYN2JXKKHFSVTASH344TBRGWDH64XQV/(f86ef6dc-4d3a-42ad-8f28-e6d5547a5007)

https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/(f86ef6dc-4d3a-42ad-8f28-e6d5547a5007)

https://github.com/pgadmin-org/pgadmin4/issues/7258(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LUYN2JXKKHFSVTASH344TBRGWDH64XQV/(af854a3a-2127-422b-91ae-364da2661108)

https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.