CVE-2024-4215

2024-05-0218:15:07

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

web.nvd.nist.gov

pgadmin

vulnerability

multi-factor authentication

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

7.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "modules": [
      "Login Module"
    ],
    "product": "pgAdmin 4",
    "repo": "https://github.com/pgadmin-org/pgadmin4",
    "vendor": "pgadmin.org",
    "versions": [
      {
        "lessThan": "8.6",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]