CVE-2024-9014

🗓️ 23 Sep 2024 17:04:00Reported by PostgreSQLType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 153 Views🌐 WEB

pgAdmin OAuth2 security flaw in versions 8.11 and earlie

Reporter	Title	Published	Views	Family All 37
BDU FSTEC	The vulnerability in the implementation of the OAuth2 protocol for managing databases in pgAdmin 4 allows a perpetrator to increase their privileges.	24 Sep 202400:00	–	bdu_fstec
Circl	CVE-2024-9014	23 Sep 202419:39	–	circl
CNNVD	pgAdmin 安全漏洞	23 Sep 202400:00	–	cnnvd
Cvelist	CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4	23 Sep 202417:04	–	cvelist
GithubExploit	Exploit for CVE-2024-9014	8 Jul 202511:12	–	githubexploit
GithubExploit	Exploit for CVE-2024-9014	26 Sep 202410:34	–	githubexploit
F5 Networks	K000148478: PostgreSQL pgAdmin vulnerability CVE-2024-9014	11 Nov 202403:01	–	f5
Fedora	[SECURITY] Fedora 40 Update: pgadmin4-8.9-3.fc40	4 Oct 202401:47	–	fedora
Fedora	[SECURITY] Fedora 41 Update: pgadmin4-8.12-1.fc41	7 Oct 202400:16	–	fedora
Tenable Nessus	Fedora 40 : pgadmin4 (2024-126d22c121)	4 Oct 202400:00	–	nessus

NVD

Node

pgadmin pgadmin_4Range<8.12postgresql

[
  {
    "defaultStatus": "affected",
    "modules": [
      "User Authentication"
    ],
    "product": "pgAdmin 4",
    "programFiles": [
      "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/templates/security/login_user.html"
    ],
    "repo": "https://github.com/pgadmin-org/pgadmin4",
    "vendor": "pgadmin.org",
    "versions": [
      {
        "lessThan": "8.12",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/pgadmin-org/pgadmin4/issues/7945

Parameter	Position	Path	Description	CWE
next	query param	/login	Exposure of OAUTH2 configuration (oauth2Config) through the login page leads to leakage of client_id and potentially client_secret via the PoC next parameter.	CWE-522