GHSA-jm9x-rx9x-wpqj

ghsaUSosv

OAuth2 client ID and secret exposed through the web browser

view advisory published 2024-09-23Licence: CC-BY-4.0

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-9014US	medium6.5	9.69% (95th)	Exploit	2024-09-23
pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret,…

references

External citations — patches, advisories, analysis.

https://github.com/pgadmin-org/pgadmin4PACKAGE
https://github.com/pgadmin-org/pgadmin4/issues/7945WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-9014ADVISORY
https://www.pgadmin.org/docs/pgadmin4/8.12/release_notes_8_12.htmlWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan