CVE-2024-3116

Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4

High · published April 4, 2024

Patch now

High probability of exploitation

CVSS calls it high at 7.4. It sits in the 99.3th percentile for exploit probability.

CVSS v3.1
7.4
EPSS
66%
Percentile
99.3
In the wild
Unconfirmed
What it is

pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.65815 · 99.3th percentile
Published
2024-04-04T14:59Z
EPSS history
Timeline
  • 04 APR 14:59Z
    Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4
    cvelistv5