CVE-2024-4215
Assigner: PostgreSQL
Published: 2024-05-02T17:42:34.880Z
State: PUBLISHED
affected: defaultStatus: affected
modules: Login Module
product: pgAdmin 4
repo: https://github.com/pgadmin-org/pgadmin4
vendor: pgadmin.org
versions: lessThan: 8.6
status: affected
version: 0
versionType: custom
datePublic: 2024-03-07T18:30:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <span style="background-color: rgb(255, 255, 255);">pgAdmin &lt;= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.</span><br>
value: pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.

metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
format: CVSS
scenarios: value: GENERAL
source: discovery: EXTERNAL
title: The Multi Factor Authentication bypass vulnerability in pgAdmin 4
x_generator: engine: Vulnogram 0.1.0-dev