CVE-2023-22298 - Vulnerability Details - OpenCVE

Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Fedoraproject	Fedora
Pgadmin	Pgadmin 4

Configuration 1 [-]

cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*

Configuration 2 [-]

cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/pgadmin-org/pgadmin4
https://github.com/pgadmin-org/pgadmin4/issues/5343
https://jvn.jp/en/jp/JVN03832974/index.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHY2B25YHIIFQ3G44TR7NNEST7FJGJPH/
https://www.pgadmin.org/

History

Mon, 17 Mar 2025 17:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Pgadmin pgadmin 4
CPEs	cpe:2.3:a:pgadmin:pgadmin::::::postgresql::*	cpe:2.3:a:pgadmin:pgadmin_4::::::postgresql::*
Vendors & Products	Pgadmin pgadmin	Pgadmin pgadmin 4

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2023-01-17T00:00:00

Updated: 2024-08-02T10:07:05.732Z

Reserved: 2022-12-28T00:00:00

Link: CVE-2023-22298

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-01-17T10:15:11.657

Modified: 2025-03-17T16:43:52.873

Link: CVE-2023-22298

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*", "matchCriteriaId": "18DDF945-9119-4283-AEA0-D3220A796C91", "versionEndExcluding": "6.14", "versionStartIncluding": "4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*", "matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL."}, {"lang": "es", "value": "La vulnerabilidad de redireccionamiento abierto en las versiones de pgAdmin 4 anteriores a la v6.14 permite que un atacante remoto no autenticado redirija a un usuario a un sitio web arbitrario y realice un ataque de phishing haciendo que el usuario acceda a una URL especialmente manipulada."}], "id": "CVE-2023-22298", "lastModified": "2025-03-17T16:43:52.873", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-01-17T10:15:11.657", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Product", "Third Party Advisory"], "url": "https://github.com/pgadmin-org/pgadmin4"}, {"source": "vultures@jpcert.or.jp", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/pgadmin-org/pgadmin4/issues/5343"}, {"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN03832974/index.html"}, {"source": "vultures@jpcert.or.jp", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHY2B25YHIIFQ3G44TR7NNEST7FJGJPH/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.pgadmin.org/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Third Party Advisory"], "url": "https://github.com/pgadmin-org/pgadmin4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/pgadmin-org/pgadmin4/issues/5343"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN03832974/index.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHY2B25YHIIFQ3G44TR7NNEST7FJGJPH/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.pgadmin.org/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "nvd@nist.gov", "type": "Primary"}]}