5.0med
CVE-2017-20052
Python pgAdmin4 uncontrolled search path
Published 4 y ago · modified 4 mo ago · JSON
CVSS
5.0
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
1.3%
percentile 71%
Public exploits
0
none known
Summary
A vulnerability classified as problematic was found in Python 2.7.13. This vulnerability affects unknown code of the component pgAdmin4. The manipulation leads to uncontrolled search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction (EPSS)
1.31% probability of exploitation in the next 30 days, higher than 71% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.4 | AV:L/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- unspecified Python
Classification
- Weakness
- CWE-427 Uncontrolled Search Path Element
References
- seclists.org /fulldisclosure/2017/Feb/92 · x_refsource_MISC, x_transferred
- vuldb.com /?id.97822 · x_refsource_MISC, x_transferred
- security.netapp.com /advisory/ntap-20220804-0005/ · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-20052
- NVD: CVE-2017-20052
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.