Windows apps · Application version · December 9, 2024

pgAdmin 4 8.14

pgAdmin 4 8.14, released December 9, 2024, fixes 5 CVEs in pgAdmin 4 (version 8.14). None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

2 rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.7947

99th percentile

Priority of the 5 CVEs

Patch now 0
                                Urgent 2
                                High 1
                                Routine 2

Applies to

Product	Version
pgAdmin 4	8.14

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2024-2044	Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4	9.9	0.7947	None reported
Urgent	CVE-2024-3116	Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4	9.8	0.6582	None reported
High	CVE-2024-4215	The Multi Factor Authentication bypass vulnerability in pgAdmin 4	8.8	0.0063	None reported
Routine	CVE-2024-9014	OAuth2 client id and secret exposed through the web browser in pgAdmin 4	6.5	0.0969	None reported
Routine	CVE-2024-4216	XSS vulnerability in /settings/store API response json payload in pgAdmin 4	5.4	0.0046	None reported