{"id":"CVE-2023-1907","published":"2025-01-09T07:26:48Z","modified":"2025-08-27T11:04:15Z","title":"Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong session","vendor":null,"product":null,"tier":"tail","description":{"text":"A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if multiple connection attempts occur simultaneously.","provenance":"source","from":"CVE.org"},"cvss":{"score":8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00445,"percentile":0.38556,"provenance":"source"},"cwes":[{"id":"CWE-488","name":"Exposure of Data Element to Wrong Session"},{"id":"CWE-276","name":"Incorrect Default Permissions"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-1907","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218384","tags":["issue-tracking","x_refsource_REDHAT"]}],"priority":{"score":13.3,"factors":[{"name":"EPSS percentile","points":7.71},{"name":"CVSS severity","points":5.6}]},"affectedVersions":[{"vendor":null,"product":null,"versions":["< 7.0"]}],"affected":[{"ecosystem":"PyPI","package":"pgadmin4","vulnerableRanges":["<7.0"],"patched":["7.0"],"from":["GHSA-7w6r-748w-mh52","PYSEC-2026-1770"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-0015","exploited":false,"provenance":"source"}}