topic Re: Postgres vulnerability CVE-2024-4215 & CVE-2024-4216 in Management & Governance

Postgres vulnerability CVE-2024-4215 & CVE-2024-4216

amarvilass — Thu, 09 May 2024 06:51:24 GMT

Hi All,

We are currently on May 2023 Patch10 version with Postgres12.

Understand from our security team that there are the below two vulnerabilities for Postgres

Cross-Site Scripting Vulnerability (CVE-2024-4216)

This vulnerability exists in pgAdmin, specifically inside the /settings/store API response json payload. Exploiting this vulnerability could allow a threat actor to execute malicious script on the client end and steal sensitive cookies.

Multi-Factor Authentication Bypass (CVE-2024-4215)

This vulnerability affects pgAdmin, which could allow a threat actor to bypass multi-factor authentication on affected versions.

Is anyone aware if it affect Qlik Sense enterprise on windows?

Thanks & Regards

Amar Shedage

Re: Postgres vulnerability CVE-2024-4215 & CVE-2024-4216

David_Friend — Thu, 09 May 2024 13:12:58 GMT

@amarvilass what specific version of Postgres are you using and is it bundled/unbundled?

Re: Postgres vulnerability CVE-2024-4215 & CVE-2024-4216

amarvilass — Sat, 11 May 2024 15:14:55 GMT

Hi @David_Friend

It is the bundled version postgres 12.5 that comes with default with the old version Feb 2022 version.

Thanks & Regards

Amar

Re: Postgres vulnerability CVE-2024-4215 & CVE-2024-4216

Maria_Halley — Tue, 14 May 2024 07:56:08 GMT

@amarvilass

It looks like this vulnerability only affects PgAdmin. PgAdmin is not installed by Qlik. It is only used if you do changes in the database.

Re: Postgres vulnerability CVE-2024-4215 & CVE-2024-4216

amarvilass — Tue, 14 May 2024 09:39:04 GMT

Thanks @Maria_Halley

The reason I was checking this is to resolve an issue with Qlik due to a custom properties being duplicated and injected multiple times after Qlik upgrade. This issue causes the jobs to fail even though the status reflect as successful. The job failure is causing the AD sync job to fail and not add new users. The solution to this lies in the below link

https://community.qlik.com/t5/Official-Support-Articles/Qlik-Sense-on-premise-reloads-fail-with-Warning-Conflict/ta-p/2034338

The solution proposed from Qlik needs the PgAdmin to be used to remove the duplicate properties. Will you be able to suggest if this will cause any issue?

Thanks & Regards

Amar