From: | Dave Page <dpage(at)pgadmin(dot)org> |
---|---|
To: | Qasim Tahir <qasimtahir(dot)qt1(at)gmail(dot)com> |
Cc: | pgadmin-hackers(at)postgresql(dot)org |
Subject: | Re: Potential Security Issue: Permissions in PgAdmin Installation Directory |
Date: | 2024-05-31 22:09:22 |
Message-ID: | CA+OCxoxsLdYma3VyceBims-=yTx7VfixLHPEqm3ULbTABcTmTQ@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgadmin-hackers |
Hi
On Thu, 30 May 2024 at 23:17, Qasim Tahir <qasimtahir(dot)qt1(at)gmail(dot)com> wrote:
> Dear PgAdmin Community,
>
> I am writing to report a potential security issue with the permissions set
> in the PgAdmin installation directory.
>
> After installing PgAdmin, I observed that several directories, including
> 'bin', 'venv', and 'web', have 775 permissions. Here are the details of the
> directory permissions:
> [image: image.png]
>
> Given the broad access provided by 775 permissions, there is a concern
> about the potential for unauthorized access or modifications.
>
>
> I would like to ask if these permissions are necessary for PgAdmin's
> operation or if they could be tightened to enhance security.
>
> Your guidance on this matter would be greatly appreciated.
>
> Thank you for your attention to this issue.
>
What platform and package is this exactly?
--
Dave Page
pgAdmin: https://www.pgadmin.org
PostgreSQL: https://www.postgresql.org
EDB: https://www.enterprisedb.com
From | Date | Subject | |
---|---|---|---|
Next Message | Dave Page | 2024-05-31 22:14:07 | Re: Messages held for moderation |
Previous Message | intmail01 | 2024-05-31 15:33:01 | Re: Pgadmin 4 cannot add or modify line in a view |