GHSA-2mvc-557g-5638

Suggest an improvement
Source
https://github.com/advisories/GHSA-2mvc-557g-5638
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-2mvc-557g-5638/GHSA-2mvc-557g-5638.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-2mvc-557g-5638
Aliases
  • CVE-2024-4215
Published
2024-05-02T18:30:55Z
Modified
2025-02-13T19:15:34.833649Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L CVSS Calculator
Summary
pgAdmin is affected by a multi-factor authentication bypass vulnerability
Details

pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.

Database specific 
{
    "nvd_published_at": "2024-05-02T18:15:07Z",
    "cwe_ids": [
        "CWE-89"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-03T20:18:57Z"
}
References

Affected packages

PyPI / pgadmin4

Package

Name
pgadmin4
View open source insights on deps.dev
Purl
pkg:pypi/pgadmin4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.6

Affected versions

4.*

4.20
4.22
4.23
4.24
4.25
4.26
4.27
4.28
4.29
4.30

5.*

5.0
5.1
5.2
5.3
5.4
5.5
5.6
5.7

6.*

6.2
6.3
6.4
6.5
6.6
6.7
6.8
6.9
6.10
6.11
6.12
6.13
6.14
6.15
6.16
6.17
6.18
6.19
6.20
6.21

7.*

7.0
7.1
7.2
7.3
7.4
7.5
7.6
7.7
7.8

8.*

8.0
8.1
8.2
8.3
8.4
8.5

Database specific 

{
    "last_known_affected_version_range": "<= 8.5"
}