CVE-2022-4223

The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server.

• CWE-94
• CWE-862

• https://github.com/pgadmin-org/pgadmin4/issues/5593Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5EYTPKHVFSDCETBJI7LBZE4EYHBPN2Q/Mailing List
• https://github.com/pgadmin-org/pgadmin4/issues/5593Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5EYTPKHVFSDCETBJI7LBZE4EYHBPN2Q/Mailing List

Published

Dec 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-42218Open Source SACCO Management System v1.0 vulnerable to SQL I…7.2
• CVE-2022-4222A vulnerability was found in SourceCodester Canteen Manageme…9.8
• CVE-2022-42221Netgear R6220 v1.1.0.114_1.0.1 suffers from Incorrect Access…8.8
• CVE-2022-42225Jumpserver 2.10.0 <= version <= 2.26.0 contains multiple sto…5.4
• CVE-2022-42227jsonlint 1.0 is vulnerable to heap-buffer-overflow via /home…7.5
• CVE-2022-42229Wedding Planner v1.0 is vulnerable to Arbitrary code executi…8.8
• CVE-2022-42230Simple Cold Storage Management System v1.0 is vulnerable to …7.2
• CVE-2022-42232Simple Cold Storage Management System v1.0 is vulnerable to …7.2
• CVE-2022-42233Tenda 11N with firmware version V5.07.33_cn suffers from an …9.8
• CVE-2022-42234There is a file inclusion vulnerability in the template mana…8.8
• CVE-2022-42235A Stored XSS issue in Student Clearance System v.1.0 allows …5.4
• CVE-2022-42236A Stored XSS issue in Merchandise Online Store v.1.0 allows …5.4