« Volver al listado

CVE-2024-6895

Estado: AplazadaMedia (6.1)—

Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and access to application can modify settings such as password and email without being prompted for the current password, enabling account takeover.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Yugabyte — Yugabyte PlatformAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-6895",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-6895",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-19T16:38:09.286512Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@yugabyte.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "ADJACENT",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@yugabyte.com",
      "affectedData": [
        {
          "vendor": "YugabyteDB",
          "product": "YugabyteDB Anywhere",
          "versions": [
            {
              "status": "affected",
              "version": "2.14.0.0",
              "versionType": "git",
              "lessThanOrEqual": "2.14.17.0"
            },
            {
              "status": "affected",
              "version": "2.16.0.0",
              "versionType": "git",
              "lessThanOrEqual": "2.16.9.0"
            },
            {
              "status": "affected",
              "version": "2.18.0.0",
              "versionType": "git",
              "lessThanOrEqual": "2.18.8.1"
            },
            {
              "status": "affected",
              "version": "2.20.0.0",
              "lessThan": "2.20.5.0",
              "versionType": "git"
            }
          ],
          "platforms": [
            "Linux",
            "Docker",
            "Kubernetes"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:yugabyte:yugabytedb:*:*:*:*:*:*:*:*"
          ],
          "vendor": "yugabyte",
          "product": "yugabytedb",
          "versions": [
            {
              "status": "affected",
              "version": "2.14.0.0",
              "versionType": "git",
              "lessThanOrEqual": "2.14.17.0"
            },
            {
              "status": "affected",
              "version": "2.16.0.0",
              "versionType": "git",
              "lessThanOrEqual": "2.16.9.0"
            },
            {
              "status": "affected",
              "version": "2.18.0.0",
              "versionType": "git",
              "lessThanOrEqual": "2.18.8.1"
            },
            {
              "status": "affected",
              "version": "2.20.0.0",
              "lessThan": "2.20.5.0",
              "versionType": "git"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-07-19T15:15:10.547",
  "references": [
    {
      "url": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
      "source": "security@yugabyte.com"
    },
    {
      "url": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@yugabyte.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and access to application can modify settings such as password and email without being prompted for the current password, enabling account takeover."
    },
    {
      "lang": "es",
      "value": "La autenticación insuficiente en la gestión de cuentas de usuario en la plataforma Yugabyte permite a los atacantes de la red local con una sesión de usuario comprometida cambiar información de seguridad crítica sin volver a autenticarse. Un atacante con sesión de usuario y acceso a la aplicación puede modificar configuraciones como la contraseña y el correo electrónico sin que se le solicite la contraseña actual, lo que permite la apropiación de la cuenta."
    }
  ],
  "lastModified": "2026-06-17T08:18:55.660",
  "sourceIdentifier": "security@yugabyte.com"
}