PT-2024-37936 · Yugabyte · Yugabyte Platform

Published 2024-07-19 · Updated 2024-07-22 · CVE-2024-6895

Positive Technologies (AI Summary)

CVSS v4.0

6.1

Medium

Base vector

AV:A/AC:H/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Yugabyte Platform (affected versions not specified)

Description The issue concerns insufficient authentication in user account management, allowing local network attackers with a compromised user session to modify critical security settings without re-authentication. This enables an attacker to change settings such as password and email without being prompted for the current password, potentially leading to account takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-6895

Affected Products

Yugabyte Platform

References · 6

• https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-6895 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6895 · Vendor Advisory
• https://t.me/cvenotify/86766 · Telegram Post
• https://t.me/cvedetector/1216 · Telegram Post
• https://t.me/cvenotify/87021 · Telegram Post