CVE-2024-6895
Insecure Account Profile Management
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Insecure Account Profile Management
| Assigner | Yugabyte |
| Reserved | 2024-07-18 |
| Published | 2024-07-19 |
| Updated | 2024-08-13 |
Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and access to application can modify settings such as password and email without being prompted for the current password, enabling account takeover.
| CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H |
CWE-306 Missing Authentication for Critical Function
https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5
