{"id":"CVE-2024-4216","published":"2024-05-02T17:42:59Z","modified":"2025-02-13T17:53:31Z","title":"XSS vulnerability in /settings/store API response json payload in pgAdmin 4","vendor":"pgadmin.org","product":"pgAdmin 4","tier":"tail","description":{"text":"pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.4,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00461,"percentile":0.39937,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/7282","tags":["issue-tracking"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/","tags":[]}],"priority":{"score":13.2,"factors":[{"name":"EPSS percentile","points":7.99},{"name":"CVSS severity","points":5.18}]},"vendorSlug":"pgadmin-org","affectedVersions":[{"vendor":"pgadmin.org","product":"pgAdmin 4","versions":["< 8.6"]}],"affected":[{"ecosystem":"PyPI","package":"pgAdmin4","vulnerableRanges":["<8.6"],"patched":["8.6"],"from":["GHSA-xv64-8p4r-94gq","PYSEC-2026-1777"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1871","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-2044","published":"2024-03-07","fixed":"8.4","kev":false,"link":{"from":"CVE-2024-2044","to":"CVE-2024-4216","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:pgAdmin4","fromFixed":"8.4","toFixed":"8.6","daysApart":56}]}},{"cve":"CVE-2024-4216","published":"2024-05-02","fixed":"8.6","kev":false}],"package":"PyPI:pgAdmin4"}}