p PatchFirst

CVE-2023-1907

CVE-2023-1907 · Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously.

CVSS 8.0 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • pgadmin4 PyPI

    Versions
    • 4.20
    • 4.22
    • 4.23
    • 4.24
    • 4.25
    • 4.26
    • 4.27
    • 4.28
    • 4.29
    • 4.30
    • 5.0
    • 5.1
    • 5.2
    • 5.3
    • 5.4
    • 5.5
    • 5.6
    • 5.7
    • 6.10
    • 6.11
    • 6.12
    • 6.13
    • 6.14
    • 6.15
    • 6.16
    • 6.17
    • 6.18
    • 6.19
    • 6.2
    • 6.20
    • 6.21
    • 6.3
    • 6.4
    • 6.5
    • 6.6
    • 6.7
    • 6.8
    • 6.9
    Affected ranges
    • ECOSYSTEM: < 7.0

    Update to 7.0

  • pgadmin3 Ubuntu:16.04:LTS

    Versions
    • 1.20.0~beta2-1build1
    • 1.20.0-3
    • 1.22.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgadmin3 Ubuntu:18.04:LTS

    Versions
    • 1.22.2-1
    • 1.22.2-2
    • 1.22.2-3
    • 1.22.2-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pgadmin3 Ubuntu:20.04:LTS

    Versions
    • 1.22.2-5build1
    • 1.22.2-6
    • 1.22.2-6build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →