Vulnerability details

CVE-2023-1907

Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session

CVSS 3.1

8.0High

Official description

A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously.

CVSS scores

Score	Version	Source	Vector
8.0High	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H`
8.0High	3.1	CVEProject cvelistV5 (CNA) (redhat)	`CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
No product information recorded.

References and advisories

https://access.redhat.com/security/cve/CVE-2023-1907 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2218384 issue-trackingx_refsource_REDHAT

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-01-09
Last updated: 2025-08-27
State: Published
Assigner (CNA): redhat

Exploit prediction (EPSS)

0.44%

Probability of exploitation in 30 days

38.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-488
Exposure of Data Element to Wrong Session
CWE-276
Incorrect Default Permissions