CVE-2024-4215 The Multi Factor Authentication bypass vulnerability in pgAdmin 4

2024-05-0217:42:34

PostgreSQL

www.cve.org

pgadmin

multi factor authentication

bypass

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "modules": [
      "Login Module"
    ],
    "product": "pgAdmin 4",
    "repo": "https://github.com/pgadmin-org/pgadmin4",
    "vendor": "pgadmin.org",
    "versions": [
      {
        "lessThan": "8.6",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]