Lucene search

K
githubGitHub Advisory DatabaseGHSA-2MVC-557G-5638
HistoryMay 02, 2024 - 6:30 p.m.

pgAdmin is affected by a multi-factor authentication bypass vulnerability

2024-05-0218:30:55
GitHub Advisory Database
github.com
5
pgadmin
vulnerability
multi-factor authentication
bypass

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

8 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.

Affected configurations

Vulners
Node
pgadmin4Range8.5
CPENameOperatorVersion
pgadmin4le8.5

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

8 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%