CVE-2024-4215

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-4215
pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.

7.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References
Link Resource
https://github.com/pgadmin-org/pgadmin4/issues/7425 Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/ Mailing List
https://github.com/pgadmin-org/pgadmin4/issues/7425 Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/ Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
History

19 Sep 2025, 13:37

Type Values Removed Values Added
First Time Pgadmin
Pgadmin pgadmin 4
Fedoraproject fedora
Fedoraproject
References () https://github.com/pgadmin-org/pgadmin4/issues/7425 - () https://github.com/pgadmin-org/pgadmin4/issues/7425 - Issue Tracking
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/ - Mailing List
CPE cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*

13 Feb 2025, 18:18

Type Values Removed Values Added
Summary (en) pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status. (en) pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.

21 Nov 2024, 09:42

Type Values Removed Values Added
References () https://github.com/pgadmin-org/pgadmin4/issues/7425 - () https://github.com/pgadmin-org/pgadmin4/issues/7425 -
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/ -

01 Aug 2024, 13:59

Type Values Removed Values Added
CWE CWE-89

10 Jun 2024, 18:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/ -

03 May 2024, 12:50

Type Values Removed Values Added
Summary
  • (es) pgAdmin &lt;= 8.5 se ve afectado por una vulnerabilidad de omisión de autenticación multifactor. Esta vulnerabilidad permite que un atacante con conocimiento del nombre de usuario y la contraseña de una cuenta legítima pueda autenticarse en la aplicación y realizar acciones confidenciales dentro de la aplicación, como administrar archivos y ejecutar consultas SQL, independientemente del estado de inscripción en MFA de la cuenta.

02 May 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-02 18:15

Updated : 2025-09-19 13:37

NVD link : CVE-2024-4215

Mitre link : CVE-2024-4215

CVE.ORG link : CVE-2024-4215

JSON object : View

Products Affected

pgadmin

  • pgadmin_4

fedoraproject

  • fedora
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')