CVE-2024-22409

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-22409
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22409.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-22409
Aliases
  • GHSA-x3v6-r479-m4xv
Published
2024-01-16T22:16:48.690Z
Modified
2026-03-14T12:27:34.214678Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Default Privileges allow for high level operations for low privileged users in datahub
Details

DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile information. The default privileges gave too many broad permissions to low privileged users. These have been constrained in PR #9067 to prevent abuse. This issue can result in privilege escalation for lower privileged users up to admin privileges, potentially, if a group with admin privileges exists. May not impact instances that have modified default privileges. This issue has been addressed in datahub version 0.12.1. Users are advised to upgrade.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-276"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22409.json"
}
References

Affected packages

Git / github.com/datahub-project/datahub

Affected ranges

Type
GIT
Repo
https://github.com/datahub-project/datahub
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
159a013b0515f8a94b88d62e4ad20aad228fac9d

Affected versions

RC-v0.*
RC-v0.8.28
v0.*
v0.1.0-alpha
v0.1.1-alpha
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.10.4
v0.10.5
v0.11.0
v0.12.0
v0.12.1rc1
v0.12.1rc2
v0.2.0-alpha
v0.4.1
v0.4.2
v0.4.3
v0.5.0
v0.5.0-BETA
v0.6.0
v0.6.1
v0.7.0
v0.7.1
v0.8.0
v0.8.0-pre
v0.8.1
v0.8.10
v0.8.11
v0.8.12
v0.8.13
v0.8.14
v0.8.15
v0.8.16
v0.8.17
v0.8.18
v0.8.19
v0.8.2
v0.8.20
v0.8.21
v0.8.22
v0.8.23
v0.8.24
v0.8.25
v0.8.26
v0.8.27
v0.8.28
v0.8.28rc1
v0.8.29
v0.8.3
v0.8.30
v0.8.31
v0.8.32
v0.8.33
v0.8.34
v0.8.35
v0.8.36
v0.8.37
v0.8.38
v0.8.39
v0.8.4
v0.8.40
v0.8.41
v0.8.42
v0.8.43
v0.8.44
v0.8.45
v0.8.5
v0.8.6
v0.8.7
v0.8.8
v0.8.9
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22409.json"