CVE-2024-2044

CRITICAL

pgAdmin <= 8.3 - Path Traversal

Title source: llm

Description

pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.

Exploits (1)

metasploit WORKING POC EXCELLENT
by Spencer McIntyre, Davide Silvetti, Abdel Adim Oisfi · rubypocpython
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/pgadmin_session_deserialization.rb

References (3)

Scores

CVSS v3 9.9
EPSS 0.8347
EPSS Percentile 99.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-31
Status published
Products (3)
fedoraproject/fedora 40
pgadmin/pgadmin_4 < 8.4
pypi/pgAdmin4 0 - 8.4PyPI
Published Mar 07, 2024
Tracked Since Feb 18, 2026