{"id":"CVE-2024-4216","published":"2024-05-02T17:42:59Z","modified":"2025-02-13T17:53:31Z","title":"XSS vulnerability in /settings/store API response json payload in pgAdmin 4","vendor":"pgadmin.org","product":"pgAdmin 4","tier":"tail","description":{"text":"pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.4,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00461,"percentile":0.39935,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/7282","tags":["issue-tracking"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/","tags":[]}],"priority":{"score":13.2,"factors":[{"name":"EPSS percentile","points":7.99},{"name":"CVSS severity","points":5.18}]},"vendorSlug":"pgadmin-org","affectedVersions":[{"vendor":"pgadmin.org","product":"pgAdmin 4","versions":["< 8.6"]}],"affected":[{"ecosystem":"PyPI","package":"pgAdmin4","vulnerableRanges":["<8.6"],"patched":["8.6"],"from":["GHSA-xv64-8p4r-94gq","PYSEC-2026-1777"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1871","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-pgadmin-org-pgadmin-4-cve-2022-0959","parents":[{"from":"CVE-2024-3116","to":"CVE-2024-4216","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["web/pgadmin/browser/templates/browser/js/utils.js"],"commits":["https://github.com/pgadmin-org/pgadmin4/commit/fbbbfe22dd468bcfef1e1f833ec32289a6e56a8b","https://github.com/pgadmin-org/pgadmin4/commit/e384c9665ae2e72376be7cefa8e652efcee93767"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2024-2044","published":"2024-03-07","fixed":"8.4","kev":false,"link":{"from":"CVE-2024-2044","to":"CVE-2024-4216","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:pgAdmin4","fromFixed":"8.4","toFixed":"8.6","daysApart":56}]}},{"cve":"CVE-2024-4216","published":"2024-05-02","fixed":"8.6","kev":false}],"package":"PyPI:pgAdmin4"}}