Insufficiently Protected Credentials (CWE-522)
pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.
This vulnerability has a high severity impact. It allows attackers to potentially gain unauthorized access to user data through the exploitation of OAuth2 authentication flaws. The impact on confidentiality, integrity, and availability is rated as HIGH, with a CVSS base score of 9.9 out of 10. The attack vector is through the network, requires low attack complexity, and no user interaction, making it relatively easy for attackers to exploit.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
As of the current information, a specific patch is not mentioned. However, given that the vulnerability affects pgAdmin versions 8.11 and earlier, it's likely that upgrading to a version later than 8.11 (if available) would address this vulnerability.
While a specific patch is not mentioned, the following mitigation steps are recommended: 1. Upgrade pgAdmin to a version newer than 8.11 if available. 2. If upgrading is not immediately possible, consider disabling OAuth2 authentication temporarily if feasible. 3. Implement strong network segmentation to limit access to pgAdmin instances. 4. Monitor for any suspicious activities related to OAuth2 authentication in pgAdmin. 5. Regularly audit and rotate OAuth2 client IDs and secrets. 6. Implement additional authentication layers where possible.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2024-9014. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-9014
A CVSS base score of 9.9 has been assigned.
Feedly estimated the CVSS score as MEDIUM
EPSS Score was set to: 0.04% (Percentile: 9.6%)
Detection for the vulnerability has been added to Qualys (731806)
CVE-2024-9014 is a critical vulnerability (CVSS: 9.9) in pgAdmin’s OAuth2 authentication system that could allow attackers to gain unauthorized access to sensitive user data by compromising client IDs and secrets. The details regarding exploitation in the wild, proof-of-concept exploits, mitigations, detections, or patches are not provided in the available information. There is no mention of downstream impacts to other third-party vendors or technology. See article
Detection for the vulnerability has been added to Qualys (5001122)