Lucene search

CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4

🗓️ 23 Sep 2024 17:00:04Reported by PostgreSQLType

Security flaw in pgAdmin 4 OAuth2

Reporter	Title	Published	Views	Family All 13
Tenable Nessus	Fedora 40 : pgadmin4 (2024-126d22c121)	4 Oct 202400:00	–	nessus
F5 Networks	K000148478: PostgreSQL pgAdmin vulnerability CVE-2024-9014	11 Nov 202400:00	–	f5
Vulnrichment	CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4	23 Sep 202417:04	–	vulnrichment
Nuclei	pgAdmin 4 - Authentication Bypass	26 Sep 202411:41	–	nuclei
CVE	CVE-2024-9014	23 Sep 202417:15	–	cve
Fedora	[SECURITY] Fedora 40 Update: pgadmin4-8.9-3.fc40	4 Oct 202401:47	–	fedora
Fedora	[SECURITY] Fedora 41 Update: pgadmin4-8.12-1.fc41	7 Oct 202400:16	–	fedora
OSV	OAuth2 client ID and secret exposed through the web browser	23 Sep 202418:30	–	osv
OSV	Security update for pgadmin4	29 Oct 202412:55	–	osv
OpenVAS	Fedora: Security Advisory (FEDORA-2024-126d22c121)	4 Oct 202400:00	–	openvas

[
  {
    "defaultStatus": "affected",
    "modules": [
      "User Authentication"
    ],
    "product": "pgAdmin 4",
    "programFiles": [
      "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/templates/security/login_user.html"
    ],
    "repo": "https://github.com/pgadmin-org/pgadmin4",
    "vendor": "pgadmin.org",
    "versions": [
      {
        "lessThan": "8.12",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/pgadmin-org/pgadmin4/issues/7945

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

23 Sep 2024 17:04Current

CVSS39.9

EPSS0.009