Advisories ยป MGASA-2022-0257

Updated pgadmin4 packages fix security vulnerability

Publication date: 13 Jul 2022
Type: security
Affected Mageia releases : 8
CVE: CVE-2022-0959


A malicious, but authorised and authenticated user can construct an HTTP
request using their existing CSRF token and session cookie to manually
upload files to any location that the operating system user account under
which pgAdmin is running has permission to write. (CVE-2022-0959)

In addition, missing requires have been added, file and directory
permissions have been corrected. Upstream update check disabled.