VulnerabilityAnalyzed
CVE-2024-4215
pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability.
HIGH 8.8EPSS 0.63%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.63%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.63% probability · 48th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- pgadmin/pgadmin 4 · fedoraproject/fedora
- Source
- f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
References
- https://github.com/pgadmin-org/pgadmin4/issues/7425Issue Tracking
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/Mailing List
- https://github.com/pgadmin-org/pgadmin4/issues/7425Issue Tracking
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/Mailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.