CVE-2024-6895

Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and access to application can modify settings such as password and email without being prompted for the current password, enabling account takeover.

CVSS

No CVSS.

References

Link	Resource
https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5
https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5

Configurations

No configuration.

History

21 Nov 2024, 09:50

Type	Values Removed	Values Added
References	~~() https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5 -~~	() https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5 -

22 Jul 2024, 13:00

Type	Values Removed	Values Added
Summary		(es) La autenticación insuficiente en la gestión de cuentas de usuario en la plataforma Yugabyte permite a los atacantes de la red local con una sesión de usuario comprometida cambiar información de seguridad crítica sin volver a autenticarse. Un atacante con sesión de usuario y acceso a la aplicación puede modificar configuraciones como la contraseña y el correo electrónico sin que se le solicite la contraseña actual, lo que permite la apropiación de la cuenta.

19 Jul 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-19 15:15

Updated : 2024-11-21 09:50

NVD link : CVE-2024-6895

Mitre link : CVE-2024-6895

CVE.ORG link : CVE-2024-6895

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2024-6895", "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security@yugabyte.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 6.1, "automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "HIGH", "vulnerableSystemIntegrity": "LOW", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "HIGH", "vulnerableSystemAvailability": "LOW", "subsequentSystemConfidentiality": "HIGH", "vulnerableSystemConfidentiality": "HIGH", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-07-19T15:15:10.547", "references": [{"url": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5", "source": "security@yugabyte.com"}, {"url": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@yugabyte.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and access to application can modify settings such as password and email without being prompted for the current password, enabling account takeover."}, {"lang": "es", "value": "La autenticaci\u00f3n insuficiente en la gesti\u00f3n de cuentas de usuario en la plataforma Yugabyte permite a los atacantes de la red local con una sesi\u00f3n de usuario comprometida cambiar informaci\u00f3n de seguridad cr\u00edtica sin volver a autenticarse. Un atacante con sesi\u00f3n de usuario y acceso a la aplicaci\u00f3n puede modificar configuraciones como la contrase\u00f1a y el correo electr\u00f3nico sin que se le solicite la contrase\u00f1a actual, lo que permite la apropiaci\u00f3n de la cuenta."}], "lastModified": "2024-11-21T09:50:29.310", "sourceIdentifier": "security@yugabyte.com"}