CVE-2024-6908 | THREATINT

Assigner	Yugabyte
Reserved	2024-07-18
Published	2024-07-19
Updated	2024-08-01

Description

Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potentially leading to unauthorized access to sensitive system functions and data.

MEDIUM: 6.0

CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H

Problem types

CWE-269 Improper Privilege Management

Product status

Default status

unaffected

2.14.0.0

affected

2.16.0.0

affected

2.18.0.0 before 2.18.7.0

affected

2.20.0.0 before 2.20.3.0

affected

References

https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662 patch

https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb patch

cve.org CVE-2024-6908

nvd.nist.gov CVE-2024-6908

Download JSON