CVE-2024-2044: Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4
pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.
Other sources
pgAdmin prior to version 8.4 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them and gain code execution.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2044?
CVE-2024-2044 is considered a critical vulnerability due to the potential for unauthenticated remote code execution.
How do I fix CVE-2024-2044?
The recommended solution for CVE-2024-2044 is to upgrade to pgAdmin version 8.4 or later.
Which versions of pgAdmin are affected by CVE-2024-2044?
CVE-2024-2044 affects all versions of pgAdmin up to and including version 8.3.
Can CVE-2024-2044 be exploited on non-Windows systems?
No, CVE-2024-2044 specifically affects pgAdmin when running on Windows systems.
What type of attack is associated with CVE-2024-2044?
CVE-2024-2044 is associated with a path-traversal attack that leads to unsafe deserialization and remote code execution.