Stored cross-site scripting in pgAdmin - CVE-2024-4216

Vulnerability identifier: #VU93852

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2024-4216

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the /settings/store API response json payload. A remote user can inject and script code in user's browser in context of vulnerable website.

pgAdmin
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
Server Applications Module
Python 3 Module
openSUSE Leap
Fedora
python-libgravatar
pgadmin4-debuginfo
pgadmin4
pgadmin4-doc
pgadmin4-web
pgadmin4-web-uwsgi
system-user-pgadmin
pgadmin4-desktop
pgadmin4-cloud

Install update from vendor's website.

pgAdmin - update to 8.6
python-libgravatar - update to 1.0.4-1.fc40
pgadmin4-debuginfo - update to 4.30-150300.3.15.1
pgadmin4 - addressed in versions 4.30-150300.3.15.1, 8.5-150600.3.3.1
pgadmin4-doc - addressed in versions 4.30-150300.3.15.1, 8.5-150600.3.3.1
pgadmin4-web - update to 4.30-150300.3.15.1
pgadmin4-web-uwsgi - addressed in versions 4.30-150300.3.15.1, 8.5-150600.3.3.1
pgadmin4 - addressed in versions 7.8-7.fc39, 8.6-1.fc40
system-user-pgadmin - update to 8.5-150600.3.3.1
pgadmin4-desktop - update to 8.5-150600.3.3.1
pgadmin4-cloud - update to 8.5-150600.3.3.1

• https://github.com/pgadmin-org/pgadmin4/issues/7282

• Multiple vulnerabilities in pgAdmin
• SUSE update for pgadmin4
• Fedora 40 update for pgadmin4, python-libgravatar
• Fedora 39 update for pgadmin4
• SUSE update for pgadmin4