Auth bypass in Yugabytedb Anywhere
CVE-2024-6895
Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and…
Vulnerability class: Broken Authentication
EPSS: 0.002 (15.0th percentile) — read the EPSS interpretation.
Affected products
- Yugabytedb Anywhere — versions 2.14.0.0, 2.16.0.0, 2.18.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@yugabyte.com (patch)
Frequently asked questions
- What is CVE-2024-6895?
- CVE-2024-6895 is a vulnerability in Yugabytedb Anywhere, classified under Missing Authentication for Critical Function. Published 2024-07-19.
- Is CVE-2024-6895 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.