CVE-2022-0959

    Dashboard / Vulnerabilities / CVE-2022-0959

    CVE-2022-0959

    Published: 16 Mar 2022Last Modified: 12 Aug 2026

    Summary:

    Details: A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0959.json, https://nvd.nist.gov/vuln/detail/CVE-2022-0959, https://bugzilla.redhat.com/show_bug.cgi?id=2063759

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -901e3ede3972b9c6f723e82e453a8e9b25205612

    Affected versions

    REL-6_6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High