CVE-2023-5002 is a critical vulnerability in pgAdmin versions prior to 7.6, affecting Fedora and pgAdmin 4. It allows an authenticated attacker to execute arbitrary commands on the server by manipulating the path validation for external PostgreSQL utilities. With a CVSS score of 8.8 (High), this flaw presents a significant risk due to its low attack complexity and high impact on confidentiality, integrity, and availability. While no public exploit code or active exploitation has been observed, its high EPSS score and FAUCET Risk Score indicate a substantial potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 7.7CPE matchmatch criteria | cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:* | ||
37CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | ||
38CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.