CVE-2023-1907 - Vulnerability Details - OpenCVE

A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2023-1907
https://bugzilla.redhat.com/show_bug.cgi?id=2218384

History

Thu, 06 Feb 2025 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-488

Thu, 06 Feb 2025 08:15:00 +0000

Type	Values Removed	Values Added
References		https://access.redhat.com/security/cve/CVE-2023-1907

Thu, 09 Jan 2025 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-276
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 09 Jan 2025 07:45:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously.
Title		Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session
References		https://bugzilla.redhat.com/show_bug.cgi?id=2218384
Metrics		cvssV3_1 `{'score': 8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2025-01-09T07:26:48.686Z

Updated: 2025-02-06T16:30:15.701Z

Reserved: 2023-04-06T10:56:57.129Z

Link: CVE-2023-1907

Vulnrichment

Updated: 2025-01-09T14:52:59.667Z

NVD

Status : Awaiting Analysis

Published: 2025-01-09T08:15:24.477

Modified: 2025-02-06T16:15:33.273

Link: CVE-2023-1907

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-1907", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2023-04-06T10:56:57.129Z", "datePublished": "2025-01-09T07:26:48.686Z", "dateUpdated": "2025-02-06T16:30:15.701Z"}, "containers": {"cna": {"title": "Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously."}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "7.0", "versionType": "semver"}], "packageName": "pgadmin", "collectionURL": "https://github.com/pgadmin-org/pgadmin4", "defaultStatus": "unaffected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2023-1907", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2218384", "name": "RHBZ#2218384", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2024-12-26T10:42:41.192Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-488", "description": "Exposure of Data Element to Wrong Session", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-488: Exposure of Data Element to Wrong Session", "timeline": [{"lang": "en", "time": "2023-04-06T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-12-26T10:42:41.192000+00:00", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2025-02-06T15:25:46.158Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-276", "lang": "en", "description": "CWE-276 Incorrect Default Permissions"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-01-09T14:51:42.745787Z", "id": "CVE-2023-1907", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-06T16:30:15.701Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-1907", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2023-04-06T10:56:57.129Z", "datePublished": "2025-01-09T07:26:48.686Z", "dateUpdated": "2025-02-06T16:30:15.701Z"}, "containers": {"cna": {"title": "Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously."}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "7.0", "versionType": "semver"}], "packageName": "pgadmin", "collectionURL": "https://github.com/pgadmin-org/pgadmin4", "defaultStatus": "unaffected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2023-1907", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2218384", "name": "RHBZ#2218384", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2024-12-26T10:42:41.192Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-488", "description": "Exposure of Data Element to Wrong Session", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-488: Exposure of Data Element to Wrong Session", "timeline": [{"lang": "en", "time": "2023-04-06T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-12-26T10:42:41.192000+00:00", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2025-02-06T15:25:46.158Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-1907", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-09T14:51:42.745787Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-09T14:52:59.667Z"}}]}}