CVE-2024-4216
Fixed in a distro release EPSS <1%CVSS 7.4
pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end.
Products: pgadmin.org pgAdmin 4, postgresql pgadmin
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pgadmin4 | 8.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise Module for Python 3 15 SP6 | pgadmin4 | 8.5-150600.3.3.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP6 | pgadmin4 | 4.30-150300.3.15.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP5 | pgadmin4 | 4.30-150300.3.15.1 |
| openSUSE Leap 15.5 | pgadmin4 | 4.30-150300.3.15.1 |
| openSUSE Leap 15.6 | pgadmin4 | 8.5-150600.3.3.1 |
| openSUSE Tumbleweed | pgadmin4 | 8.8-1.1 |