MGASA-2022-0257

    Dashboard / Vulnerabilities / MGASA-2022-0257

    MGASA-2022-0257

    Published: 13 Jul 2022Last Modified: 16 Apr 2026
    Upstream:
    CVE-2022-0959

    Summary: Updated pgadmin4 packages fix security vulnerability

    Details: A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write. (CVE-2022-0959) In addition, missing requires have been added, file and directory permissions have been corrected. Upstream update check disabled.

    References: https://advisories.mageia.org/MGASA-2022-0257.html, https://bugs.mageia.org/show_bug.cgi?id=30385, https://lists.opensuse.org/archives/list/[email protected]/thread/JSL3A3EFXELNQREOPMKA3CGCYH5WGQXK/

    Affected packages

    Package

    Name: pgadmin4

    Purl: pkg:rpm/mageia/pgadmin4?arch=source&distro=mageia-8

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -4.30-5.mga8

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    MGASA-2022-0257 | CVE-DB