PT-2023-32943 · Audited · Audited
Htrgouvea
·
Published
2023-05-01
·
Updated
2025-11-28
·
CVE-2024-22047
CVSS v3.1
3.1
Low
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Audited versions 4.0.0 through 5.3.3
Description
A race condition exists in Audited that can result in an authenticated user causing audit log entries to be attributed to another user. This issue is related to Audited's use of
Thread.current in certain setups with threaded web servers, which can incorrectly attribute audits to the wrong user. The problem was first identified in November 2021 and a solution was implemented in a pull request, with the fix being published in version 5.3.3.Recommendations
For Audited versions 4.0.0 through 5.3.3, update to version 5.3.3 or later to resolve the issue. As a temporary workaround, consider restricting access to threaded web server setups to minimize the risk of exploitation.
Exploit
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Audited