CVE-2024-9014

The vulnerability classified as CWE-522 (Insufficiently Protected Credentials) indicates that OAuth2 authentication data — client ID and client secret — are stored or transmitted in an insufficiently protected manner. A logged-in attacker with network access can obtain this data without needing to meet additional conditions (low privilege level, no user interaction required). Obtaining the client secret allows impersonation of the application and takeover of control over the OAuth2 authorization flow.

An attacker can obtain unauthorized access to user accounts and their data, and by compromising the client secret — also impersonate the application within the OAuth2 authentication process, resulting in complete breach of confidentiality, integrity, and availability of the environment.

pgAdmin 4 should be updated to a version higher than 8.11. Details regarding available patches can be found in the vendor's references: https://github.com/pgadmin-org/pgadmin4/issues/7945

pgAdmin 4 versions 8.11 and earlier using OAuth2 authentication