CVE-2024-9014 is a critical OAuth2 authentication vulnerability affecting pgAdmin versions 8.11 and earlier. An attacker can exploit this flaw to obtain the client ID and secret, potentially leading to unauthorized access to user data. With a CVSS score of 6.5 (Medium) and an EPSS score indicating high exploitability, this vulnerability presents a significant risk. While not yet added to CISA's KEV catalog, Nuclei templates for an authentication bypass exist, and there is community discussion surrounding the issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 8.12CPE matchmatch criteria | cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.