CVE-2024-3116

HIGH

pgAdmin <=8.4 - RCE

Title source: llm

Description

pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.

Exploits (2)

nomisec WORKING POC 12 stars
by TechieNeurons · poc
https://github.com/TechieNeurons/CVE-2024-3116_RCE_in_pgadmin_8.4
metasploit WORKING POC EXCELLENT
by M.Selim Karahan, Mustafa Mutlu, Ayoub Mokhtar · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/pgadmin_binary_path_api.rb

References (4)

Scores

CVSS v3 7.4
EPSS 0.9068
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Details

CWE
CWE-77
Status published
Products (3)
fedoraproject/fedora 39
pgadmin/pgadmin_4 < 8.4
pypi/pgadmin4 0 - 8.5PyPI
Published Apr 04, 2024
Tracked Since Feb 18, 2026