CVE-2022-4223 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2022-4223 Interim 1 10 2023-10-13T23:20:40Z current 2022-12-08T00:43:25Z 2023-10-13T23:20:40Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2022-4223 The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Real Time 15 SP3 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Manager Proxy 4.2 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Manager Retail Branch Server 4.2 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Manager Server 4.2 SUSE Linux Enterprise Module for Server Applications 15 SP4 pgadmin4 pgadmin4-doc pgadmin4-web pgadmin4 as a component of SUSE CaaS Platform 4.0 pgadmin4-doc as a component of SUSE CaaS Platform 4.0 pgadmin4-web as a component of SUSE CaaS Platform 4.0 pgadmin4 as a component of SUSE Enterprise Storage 6 pgadmin4 as a component of SUSE Enterprise Storage 7 pgadmin4 as a component of SUSE Enterprise Storage 7.1 pgadmin4-doc as a component of SUSE Enterprise Storage 7.1 pgadmin4-web as a component of SUSE Enterprise Storage 7.1 pgadmin4 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS pgadmin4-web as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS pgadmin4 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS pgadmin4-web as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS pgadmin4 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS pgadmin4-doc as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS pgadmin4-web as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS pgadmin4 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS pgadmin4-web as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS pgadmin4 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 pgadmin4-doc as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 pgadmin4-web as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 pgadmin4 as a component of SUSE Linux Enterprise Real Time 15 SP3 pgadmin4-doc as a component of SUSE Linux Enterprise Real Time 15 SP3 pgadmin4-web as a component of SUSE Linux Enterprise Real Time 15 SP3 pgadmin4 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise Server 15 SP1-LTSS pgadmin4-web as a component of SUSE Linux Enterprise Server 15 SP1-LTSS pgadmin4 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS pgadmin4-doc as a component of SUSE Linux Enterprise Server 15 SP2-LTSS pgadmin4-web as a component of SUSE Linux Enterprise Server 15 SP2-LTSS pgadmin4 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 pgadmin4-doc as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 pgadmin4-web as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 pgadmin4 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 pgadmin4-doc as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 pgadmin4-web as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 pgadmin4 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 pgadmin4-doc as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 pgadmin4-web as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 pgadmin4 as a component of SUSE Manager Proxy 4.2 pgadmin4-doc as a component of SUSE Manager Proxy 4.2 pgadmin4-web as a component of SUSE Manager Proxy 4.2 pgadmin4 as a component of SUSE Manager Retail Branch Server 4.2 pgadmin4-doc as a component of SUSE Manager Retail Branch Server 4.2 pgadmin4-web as a component of SUSE Manager Retail Branch Server 4.2 pgadmin4 as a component of SUSE Manager Server 4.2 pgadmin4-doc as a component of SUSE Manager Server 4.2 pgadmin4-web as a component of SUSE Manager Server 4.2 The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server. CVE-2022-4223 SUSE CaaS Platform 4.0:pgadmin4 SUSE CaaS Platform 4.0:pgadmin4-doc SUSE CaaS Platform 4.0:pgadmin4-web SUSE Enterprise Storage 6:pgadmin4 SUSE Enterprise Storage 7.1:pgadmin4 SUSE Enterprise Storage 7.1:pgadmin4-doc SUSE Enterprise Storage 7.1:pgadmin4-web SUSE Enterprise Storage 7:pgadmin4 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:pgadmin4 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:pgadmin4-doc SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:pgadmin4-web SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:pgadmin4 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:pgadmin4-doc SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:pgadmin4-web SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:pgadmin4 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:pgadmin4-doc SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:pgadmin4-web SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:pgadmin4 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:pgadmin4-doc SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:pgadmin4-web SUSE Linux Enterprise Module for Server Applications 15 SP4:pgadmin4 SUSE Linux Enterprise Module for Server Applications 15 SP4:pgadmin4-doc SUSE Linux Enterprise Module for Server Applications 15 SP4:pgadmin4-web SUSE Linux Enterprise Real Time 15 SP3:pgadmin4 SUSE Linux Enterprise Real Time 15 SP3:pgadmin4-doc SUSE Linux Enterprise Real Time 15 SP3:pgadmin4-web SUSE Linux Enterprise Server 15 SP1-LTSS:pgadmin4 SUSE Linux Enterprise Server 15 SP1-LTSS:pgadmin4-doc SUSE Linux Enterprise Server 15 SP1-LTSS:pgadmin4-web SUSE Linux Enterprise Server 15 SP2-LTSS:pgadmin4 SUSE Linux Enterprise Server 15 SP2-LTSS:pgadmin4-doc SUSE Linux Enterprise Server 15 SP2-LTSS:pgadmin4-web SUSE Linux Enterprise Server for SAP Applications 15 SP1:pgadmin4 SUSE Linux Enterprise Server for SAP Applications 15 SP1:pgadmin4-doc SUSE Linux Enterprise Server for SAP Applications 15 SP1:pgadmin4-web SUSE Linux Enterprise Server for SAP Applications 15 SP2:pgadmin4 SUSE Linux Enterprise Server for SAP Applications 15 SP2:pgadmin4-doc SUSE Linux Enterprise Server for SAP Applications 15 SP2:pgadmin4-web SUSE Linux Enterprise Server for SAP Applications 15 SP3:pgadmin4 SUSE Linux Enterprise Server for SAP Applications 15 SP3:pgadmin4-doc SUSE Linux Enterprise Server for SAP Applications 15 SP3:pgadmin4-web SUSE Manager Proxy 4.2:pgadmin4 SUSE Manager Proxy 4.2:pgadmin4-doc SUSE Manager Proxy 4.2:pgadmin4-web SUSE Manager Retail Branch Server 4.2:pgadmin4 SUSE Manager Retail Branch Server 4.2:pgadmin4-doc SUSE Manager Retail Branch Server 4.2:pgadmin4-web SUSE Manager Server 4.2:pgadmin4 SUSE Manager Server 4.2:pgadmin4-doc SUSE Manager Server 4.2:pgadmin4-web important 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H