CVE-2024-22409

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-22409

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22409.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-22409

Aliases

GHSA-x3v6-r479-m4xv

Published

2024-01-16T22:16:48.690Z

Modified

2026-07-15T01:49:10.705876695Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Default Privileges allow for high level operations for low privileged users in datahub

Details

DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile information. The default privileges gave too many broad permissions to low privileged users. These have been constrained in PR #9067 to prevent abuse. This issue can result in privilege escalation for lower privileged users up to admin privileges, potentially, if a group with admin privileges exists. May not impact instances that have modified default privileges. This issue has been addressed in datahub version 0.12.1. Users are advised to upgrade.

Database specific

{
    "cwe_ids": [
        "CWE-276"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22409.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/datahub-project/datahub

Affected ranges

Type

GIT

Repo

https://github.com/datahub-project/datahub

Events

Introduced

Fixed

159a013b0515f8a94b88d62e4ad20aad228fac9d

Database specific

{
    "cpe": "cpe:2.3:a:datahub_project:datahub:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.12.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

RC-v0.*

RC-v0.8.28

v0.*

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.10.5

v0.11.0

v0.12.0

v0.12.1rc1

v0.12.1rc2

v0.4.1

v0.4.2

v0.4.3

v0.5.0

v0.5.0-BETA

v0.6.0

v0.6.1

v0.7.0

v0.7.1

v0.8.0

v0.8.0-pre

v0.8.1

v0.8.10

v0.8.11

v0.8.12

v0.8.13

v0.8.14

v0.8.15

v0.8.16

v0.8.17

v0.8.18

v0.8.19

v0.8.2

v0.8.20

v0.8.21

v0.8.22

v0.8.23

v0.8.24

v0.8.25

v0.8.26

v0.8.27

v0.8.28

v0.8.28rc1

v0.8.29

v0.8.3

v0.8.30

v0.8.31

v0.8.32

v0.8.33

v0.8.34

v0.8.35

v0.8.36

v0.8.37

v0.8.38

v0.8.39

v0.8.4

v0.8.40

v0.8.41

v0.8.42

v0.8.43

v0.8.44

v0.8.45

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

v0.9.0

v0.9.1

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v0.9.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22409.json"