Cross-Site Scripting (XSS)

2024-05-0607:00:32

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

pgadmin

xss

vulnerability

json

input sanitization

client-side

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

AI Score

6.1

Confidence

High

EPSS

Percentile

9.0%

JSON

pgAdmin is vulnerable to a Cross-site Scripting (XSS) in the JSON payload of the /settings/store API response. The vulnerability arises due to inadequate input sanitization, enabling attackers to inject and execute malicious scripts on the client’s side.