What is CVE-2024-6908?

CVE-2024-6908 is a vulnerability in Yugabytedb Anywhere, classified under Improper Privilege Management. Published 2024-07-19.

Is CVE-2024-6908 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Privilege escalation in Yugabytedb Anywhere

CVE-2024-6908

Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potentially leading to unauthorized access to sensitive system functions and data.

Vulnerability class: Privilege Escalation

EPSS: 0.003 (17.3th percentile) — read the EPSS interpretation.

Affected products

Yugabytedb Anywhere — versions 2.14.0.0, 2.16.0.0, 2.18.0.0

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security@yugabyte.com (patch)
security@yugabyte.com (patch)

Frequently asked questions

What is CVE-2024-6908?: CVE-2024-6908 is a vulnerability in Yugabytedb Anywhere, classified under Improper Privilege Management. Published 2024-07-19.
Is CVE-2024-6908 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.