CVE-2024-9014: OAuth2 client ID and secret exposed through the web browser

September 23, 2024 (updated October 1, 2024)

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

References

github.com/advisories/GHSA-jm9x-rx9x-wpqj
github.com/pgadmin-org/pgadmin4
github.com/pgadmin-org/pgadmin4/issues/7945
nvd.nist.gov/vuln/detail/CVE-2024-9014
www.pgadmin.org/docs/pgadmin4/8.12/release_notes_8_12.html

Code Behaviors & Features

Detect and mitigate CVE-2024-9014 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →