GHSA-7w6r-748w-mh52

pgAdmin has Incorrect Default Permissions

Source: GitHub Advisory Database (reviewed) High CVE-2023-1907

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pgadmin4	< 7.0	7.0

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-1907 advisory
https://github.com/pgadmin-org/pgadmin4/issues/6100 web
https://github.com/pgadmin-org/pgadmin4/commit/fa29ba91632634d961f937ce3ed2c3b5a9d78f59 web
https://access.redhat.com/security/cve/CVE-2023-1907 web
https://bugzilla.redhat.com/show_bug.cgi?id=2218384 web
https://github.com/pgadmin-org/pgadmin4 package
https://github.com/pgadmin-org/pgadmin4/blob/a9974b418c49760d3989b7fb25e052ff16b89ac6/docs/en_US/release_notes_7_0.rst web