PT-2023-32943 · Audited · Audited
Htrgouvea
·
Publicado
2023-05-01
·
Atualizado
2025-11-28
·
CVE-2024-22047
CVSS v3.1
3.1
Baixa
| Vetor | AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Audited versions 4.0.0 through 5.3.3
Description
A race condition exists in Audited that can result in an authenticated user causing audit log entries to be attributed to another user. This issue is related to Audited's use of
Thread.current in certain setups with threaded web servers, which can incorrectly attribute audits to the wrong user. The problem was first identified in November 2021 and a solution was implemented in a pull request, with the fix being published in version 5.3.3.Recommendations
For Audited versions 4.0.0 through 5.3.3, update to version 5.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to threaded web server setups to minimize the risk of exploitation.
Exploit
Correção
Race Condition
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Audited