CVE-2024-6908

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-6908

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6908.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-6908

Published

2024-07-19T14:57:00.607Z

Modified

2026-07-15T17:34:35.604593Z

Severity

6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H CVSS Calculator

Summary

Admin Can Escalate Privileges to SuperAdmin Using Manual PUT Request

Details

Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potentially leading to unauthorized access to sensitive system functions and data.

Database specific

{
    "cwe_ids": [
        "CWE-269"
    ],
    "cna_assigner": "Yugabyte",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6908.json"
}

References

Affected packages

Git / github.com/yugabyte/yugabyte-db

Affected ranges

Type

GIT

Repo

https://github.com/yugabyte/yugabyte-db

Events

Introduced

ca570194beaf8b2c4f352930e3262c0a34cb9c6a

Introduced

1cb99f52bd7dd7a95de0a94b6c20aa94b1ef52ff

Introduced

c29ea61fcda1ee975bad57db8a69ba4349c363c4

Introduced

0026607ed49516b4d5770f5479dd5d60d44710af

Fixed

cf96d182fcd2c7a72841936b9352b27b6df39594

Fixed

05ceb5b37b5f1c25a4216dfdbad14769541e71c8

Fixed

03b193de40b79329439bb9968a7d27a1cc57d662

Fixed

68f01680c565be2a370cfb7734a1b3721d6778bb

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.14.0.0"
        },
        {
            "last_affected": "2.14.17.0"
        },
        {
            "introduced": "2.16.0.0"
        },
        {
            "last_affected": "2.16.9.0"
        },
        {
            "introduced": "2.18.0.0"
        },
        {
            "fixed": "2.18.7.0"
        },
        {
            "introduced": "2.20.0.0"
        },
        {
            "fixed": "2.20.3.0"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6908.json"

vanir_signatures

[
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "23136404727938099402094247942867305506",
                "268109784697180586888374699270357321183",
                "170928423322184071298563136088902474222",
                "326561129504036851046669166642755468371",
                "298104032484539792911617455937168306915",
                "149115523116181273154637434622715853811"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-6908-0ee488bc",
        "target": {
            "file": "managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "38386941464383662547969588584889867108",
                "50540687600443760669488047591215787241",
                "73952081617020963097355328443176244596",
                "70935220895179637138702705709145497838"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-6908-2d2f8719",
        "target": {
            "file": "managed/src/main/java/com/yugabyte/yw/controllers/YbcController.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "9270452990139907395854376270891003847",
            "length": 406.0
        },
        "id": "CVE-2024-6908-4157cef5",
        "target": {
            "function": "FsManager::SetUniverseUuidOnTserverInstanceMetadata",
            "file": "src/yb/fs/fs_manager.cc"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "79064002415265059393588741746696376430",
                "98364597092808119132528313496454430681",
                "319542160979610774972785955666237474084"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-6908-44343954",
        "target": {
            "file": "src/yb/fs/fs_manager.h"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "139370573945451618663885754161498715223",
                "266623607083603784050938695114972981634",
                "130112624142382789937209244321844834115",
                "307040615518753913927498010386376339681",
                "98944768063746834533446407501667324937",
                "289851302489464650630122245561967978198",
                "253996709970718046949717604850777391030"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-6908-45324a05",
        "target": {
            "file": "src/yb/tserver/tablet_server.cc"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "277817556653446693388553253257621341237",
            "length": 704.0
        },
        "id": "CVE-2024-6908-463dd6ec",
        "target": {
            "function": "CatalogManager::SetUniverseUuidIfNeeded",
            "file": "src/yb/master/catalog_manager.cc"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "260640685449145077670956618448490194240",
                "132824703554761486526082841411616587553",
                "3443303361738249408599957621375235887",
                "65170522159532932319435228005564881956",
                "276466283208890082659457936155447628434",
                "76155869858041626792071782866587021185"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-6908-52ea7749",
        "target": {
            "file": "src/yb/integration-tests/master_heartbeat-itest.cc"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "95961142753903333428026998788644242502",
            "length": 3363.0
        },
        "id": "CVE-2024-6908-5ee9846c",
        "target": {
            "function": "TEST_F",
            "file": "src/yb/master/sys_catalog-test.cc"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "87232531819426965628236045872743977435",
            "length": 1183.0
        },
        "id": "CVE-2024-6908-757f5512",
        "target": {
            "function": "SetUsage",
            "file": "src/yb/tools/ts-cli.cc"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "192138964171095151355969977394648803083",
                "59000782050820667527649063845504079851",
                "336975985142418399781436410193887473031",
                "242754815263414101816362273782782127834",
                "127488467474057792402601833945847662623",
                "152409963728829890162000095304891851384",
                "102364447443960591539983625131565300172"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-6908-834faede",
        "target": {
            "file": "managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "290251985707263117975818033644792522846",
            "length": 1242.0
        },
        "id": "CVE-2024-6908-83d97e14",
        "target": {
            "function": "changeRole",
            "file": "managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "164495929955642430828837642071415873989",
                "87463839579780457734909665572224221610",
                "86381345174084607859049864578468158582"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-6908-8ca12db1",
        "target": {
            "file": "src/yb/tserver/tablet_server.h"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "192138964171095151355969977394648803083",
                "150185239929966929246043502681959992876",
                "48249719473128898346638968896278204201",
                "93583001150838198363284357834164625722",
                "240980066450593003092558615534753796318",
                "30872787694841923490617795693088377474",
                "306130394003671881438949679276819739079"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-6908-96bccd8f",
        "target": {
            "file": "managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "218473803069175361052691556291027949332",
            "length": 2957.0
        },
        "id": "CVE-2024-6908-adaa09bc",
        "target": {
            "function": "create",
            "file": "managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "244315558011444723468404636653350565339",
                "70875866439291314909591040235641565812",
                "284595706535117114524245614984802277874",
                "53192008597845094654033988643726168814",
                "211021415317124669363365284812746656915",
                "238488733120132698072186591030819310729",
                "81783550171452274380889987762078739077",
                "211204257335434772337976447903112175805",
                "275236482796160002546865249970365077129"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-6908-bb18e6a8",
        "target": {
            "file": "src/yb/fs/fs_manager.cc"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "181171011168389764701270601946922006677",
            "length": 650.0
        },
        "id": "CVE-2024-6908-be44e612",
        "target": {
            "function": "changeRole",
            "file": "managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "237354429522577044109177494101787548941",
                "211400997372667413658660421849401714430",
                "7133332097966779782481100755711308007",
                "338239631061912920350906014855611733757",
                "228765431152618453605020712729360338103",
                "296366503107908755615771344440913724399",
                "114351513282617695254676020735441014767",
                "224948002099062506411862384109185122223",
                "214670557192743591551153465664582942632",
                "110567995294505134054185098562114171049",
                "220914419148803242151606760579397657598",
                "1593809192819880733474099111634633234",
                "266184935541897566748098815944626231482",
                "138750627289315847641348234367167840754",
                "252936309955370085402885239398214513676",
                "10613355082481775305842507758982500740",
                "215299388318682120168952217358615033703",
                "198123905481304552070349082088112060974",
                "339377125428957676059174134929630457731",
                "51048856595926066447518854995018081435",
                "230294185195687736903955554157525849313",
                "9655602661891619682567075501288542781",
                "98592675390803068331182981134023498644",
                "333215751472926717017449411521464579315",
                "25406459370583947178045103367823973531"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-6908-c1d06980",
        "target": {
            "file": "src/yb/tools/ts-cli.cc"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "23136404727938099402094247942867305506",
                "268109784697180586888374699270357321183",
                "170928423322184071298563136088902474222",
                "326561129504036851046669166642755468371",
                "298104032484539792911617455937168306915",
                "149115523116181273154637434622715853811"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-6908-c584c740",
        "target": {
            "file": "managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "300041116249514024298695713106473501197",
                "92498842114088335956793540979786687449",
                "115859639279101588559625599082728542789",
                "206337709066049007216836975830535928846"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-6908-cd290669",
        "target": {
            "file": "src/yb/master/sys_catalog-test.cc"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "94472313349444251696714769942989402502",
                "175825328096078340581831539718526510924",
                "322761239142309100645111905894868041194",
                "177167192139262970439819002295802385343",
                "299849889133132905186726729443974644185",
                "76700672274358858010896070746857971442",
                "116222538556369132130942505520687518005"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-6908-d68cde28",
        "target": {
            "file": "src/yb/master/catalog_manager.cc"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "147296581769899178307756026745589266932",
            "length": 1127.0
        },
        "id": "CVE-2024-6908-d87757c9",
        "target": {
            "function": "create",
            "file": "managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "266280605175838146786601932960805018943",
            "length": 2649.0
        },
        "id": "CVE-2024-6908-deca5fd0",
        "target": {
            "function": "CatalogManager::SetClusterConfig",
            "file": "src/yb/master/catalog_manager.cc"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594",
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "function_hash": "79224146666083883082301530431690074110",
            "length": 5793.0
        },
        "id": "CVE-2024-6908-e0bc37eb",
        "target": {
            "function": "TsCliMain",
            "file": "src/yb/tools/ts-cli.cc"
        },
        "deprecated": false
    },
    {
        "source": "https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594",
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "188143512696110015370400684649044834049",
                "179704887801823849469219318249574214559",
                "67192419256964213198543097717480413632"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-6908-feb3b8f3",
        "target": {
            "file": "src/yb/tserver/tablet_service.h"
        },
        "deprecated": false
    }
]

vanir_signatures_modified

"2026-07-15T17:34:35Z"