{"id":"CVE-2024-6895","summary":"Insecure Account Profile Management","details":"Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and access to application can modify settings such as password and email without being prompted for the current password, enabling account takeover.","modified":"2026-08-18T16:55:54.005336Z","published":"2024-07-19T14:47:50.432Z","database_specific":{"cwe_ids":["CWE-306"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6895.json","cna_assigner":"Yugabyte"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6895.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6895"},{"type":"FIX","url":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yugabyte/yugabyte-db","events":[{"introduced":"ca570194beaf8b2c4f352930e3262c0a34cb9c6a"},{"introduced":"1cb99f52bd7dd7a95de0a94b6c20aa94b1ef52ff"},{"introduced":"c29ea61fcda1ee975bad57db8a69ba4349c363c4"},{"introduced":"0026607ed49516b4d5770f5479dd5d60d44710af"},{"fixed":"9687371d8777f876285b737a9d01995bc46bafa5"}],"database_specific":{"extracted_events":[{"introduced":"2.14.0.0"},{"last_affected":"2.14.17.0"},{"introduced":"2.16.0.0"},{"last_affected":"2.16.9.0"},{"introduced":"2.18.0.0"},{"last_affected":"2.18.8.1"},{"introduced":"2.20.0.0"},{"fixed":"2.20.5.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-6895.json","vanir_signatures_modified":"2026-08-18T16:55:54Z","vanir_signatures":[{"id":"CVE-2024-6895-169284c8","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5","target":{"file":"managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java","function":"testUpdateUserProfileValidOnlyPassword"},"deprecated":false,"digest":{"function_hash":"238964373452549663257251932304738075087","length":890}},{"signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5","target":{"file":"managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java","function":"testPasswordChangeInvalidPassword"},"deprecated":false,"digest":{"function_hash":"143555286364527243140061390472701025452","length":778},"id":"CVE-2024-6895-1e0cccb2","signature_type":"Function"},{"source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5","target":{"file":"managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java","function":"testUpdateUserProfileNullifyTimezone"},"deprecated":false,"digest":{"function_hash":"149133980081874155652305980922866881535","length":1073},"id":"CVE-2024-6895-24357a1c","signature_type":"Function","signature_version":"v1"},{"target":{"file":"managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java","function":"testUpdateUserProfileValid"},"deprecated":false,"digest":{"function_hash":"194835205870919087484785019312383074235","length":1111},"id":"CVE-2024-6895-57e14abf","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5"},{"target":{"file":"managed/src/main/java/com/yugabyte/yw/rbac/handlers/AuthorizationHandler.java"},"deprecated":false,"digest":{"line_hashes":["221954258843129905092461824339088703488","189055111379491193824982451105330234672","296868805285795244603188251743167261393","139991841111366215294450660057197677579","324566051529180370493810080138063837343","17494261785147379361842817287472465512","20522370051166458158050488280298230053","244515948328907504651681440880947434290","140022381546428663102301106445049229359","80544288545216299503154082108437567418","93421919138892481068406024939468630916","301413765618320360323394464386563057143","334244901324713293601244956970699021821","137473671738508866631489410991256528605","308995948438744566838744759763475017398","61707086101852707243700754116331255876","278032983532089276082340558142368681409","32114590439602919276836430300407682942","92940421073132649787057308294222826047","4963522875977362775434220524510814872","155346094285145684677138253307536163654","18109905741285251012175914807313051249","172397210954310268230949611838121246002","138532111079202085851949190709513462243"],"threshold":0.9},"id":"CVE-2024-6895-9b212c9a","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5"},{"target":{"file":"managed/src/main/java/com/yugabyte/yw/common/RedactingService.java"},"deprecated":false,"digest":{"line_hashes":["26321677373176286356460168310404404924","38029626468336420718574741806170635640","62553867366308554820558356078978096774","192150148749309895819672499616724345515"],"threshold":0.9},"id":"CVE-2024-6895-9cd5fb00","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5"},{"id":"CVE-2024-6895-a18848b3","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5","target":{"file":"managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java","function":"setUp"},"deprecated":false,"digest":{"length":259,"function_hash":"36262955468535495196093791459001094786"}},{"digest":{"line_hashes":["326415609636096164901291895346679064680","298152909351094244796869867757858602913","128512709214130369533833023104096788026","159532982956982250735847366349459063191","26419059889531928922932627294133641543","297846214686697129386226114145077970168","46097254031552621874132827133783071695","185866354728001036161656366776396371611","251875045896436925334071535604128541068","175493583298614036217158563834079372981","199923582412401960442889247622350927364","335703851974337726036396115035609152037","292557168745466521140154416368891193261","261087039907919605957749581356859360725","191653986073340560251743109776924569716","68643866534324391027260581395431230015","255723323192999641919612041561007333514","261134172649569442466723027818612155037","248666839776606506435280356724817325364","10585987604019295945311538670147365463","82531610282056918855813950275795325797","231775534482322771493235955544555262188","297944956211191018901874741811339991327","49183759075512775593987441521955554551","171301227671100890109977340405702618449","7181375929154412362108942031410514285","151290630918516271496192746529847537505","245963785967892417711114914051628966653","327814501393872007483181465246755986115","338277499625139139344495605701732563296","154888016761659538920370820179284260968","277919677742684730440057771326309021420","148951148463620034320853993741541093178","78907833474055895116843771169278874746","96991896219440762605384190476786123336","196231316704569454178454370154924313789","125571193865282501578148937267913441131","103731371960293352906917190408509755110","116098005551718557055260608735187183242","84014681734988156499325043630304280024","95061489157951142259157201239268852377","97282262417947906755511006747359411067","258414524541643706957974892254812298861","283106770642912082463458828992015783613","298333857478925737009663276478300445855","138091800922334408301901177506854663525","251677730246463453326789307825386544155","304182955349005931526488481122326884148","133708970437109974660349379886236699709","337698393293564631379616829356406437198","15963932301687891669892805775407076575","21600314893138716996607819098891167397","189316960305257622392921843645347730866","189921456224339442461066912811897678704","1048106638043349438675702840383728173","168800700335205717804123977501224852430","338941496630847652935932625716753464829","237722828634425176750920727542483824376","154888016761659538920370820179284260968","277919677742684730440057771326309021420","148951148463620034320853993741541093178","78907833474055895116843771169278874746","239575283920097119536470724121465356417","187642849992065728781255104329830261403","182796925872711245324699100454653441358","285440981131593004559891448541675018372","14092248491599145272017974681645365148","74750732002684589526133006443447089460","173214807145808808336209340238746893459","10354451427533759736669511146476862388","316755477883378178425165759304972546109","96528121339453985006561069102411635843","288360187849311759026212698235368614904","25897477046009780195706251522465118742"],"threshold":0.9},"id":"CVE-2024-6895-aa2a1b09","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5","target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5","target":{"file":"managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java","function":"testUpdateUserProfileInvalidPassword"},"deprecated":false,"digest":{"function_hash":"18703274237619741009699678654879260194","length":872},"id":"CVE-2024-6895-b4af64a0"},{"source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5","target":{"file":"managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java"},"deprecated":false,"digest":{"line_hashes":["120005149001946206336292075069416215719","70162802048050543570222152913330425986","144554300580073787425822542163490623393","48561982941994781370378052192437687742","52701455977616860875344428526499740579","198686944104796747411086114931676874646","208484704621978464385359701990470252500","333752982196500653570419344445311049950","168634041682837025806706475448842919757","294518181494534257463470022366507489981","325905825988335201815848335344005158712","309129141571898273528199442075610792296","246088298842752267679530471006695065357","36766503988661380382767941572048777491","135335270848263168321169580464049387995","280793010126232641662236906692956681410","183295225560929702679727435707684937296","180799156496038172686381461079301175520","12206569784226528800882937745899456366","319791092344380087031542596190005711841","236181823625831979533593714370239516746","323611132058094499718937617691414348866","81159629577926444449043232782702484675","279675769329626192583100833132277454893","340168000552593114678315444410239016544","113334341574853545472333378085102694595","117154095003035199201049243164294454079","167892399770306782513724771096901386370","126743597959871658982247599010344181523","248171407908208369010609983352983062338","172953441490949274913567314543701753999","308629593316627906199208503610232168730","122684635699485832698967289565752578596","56805441029399141595933279327415758747","236062607395241103309639091709637807769","41911509262685000058609037927424188467","258743697711810721188101579962548302934","310439047633909144813053540216446384617","263284034739401755304947987564800236037","69931212808607448803531976690202200883","159556733443648651777686498302515150279","90501127774193579057111049370308139263","219805546601402629942328490516022489295","296325593552383293327124738726107903046","185473631073050484188673037394052463997","227630491840200224225452306515879373687","13101529609456087772061211944953593731","179597753108268786536772706952068227761","337292538108660914171845829977241476067","50263169224006444012195800335519632270","68206322126359521449588736313859181760","119899699267688717964441449453312405634","238640467854102309115013416957739517978","172953441490949274913567314543701753999","308629593316627906199208503610232168730","122684635699485832698967289565752578596","56805441029399141595933279327415758747","207733675205603154851065465904418453724","287541147080965347363400983322204962461","165709385601119425581269462911437445468","94230026174649219753708832309813113966","275364588437779057751547890834654885417","128089194807695572193436054687926546239","130016030095310468751148087440882521442","111529647740625874778412231023084165236","95104020226363816307381025407163441521","11677221610751472877848758368607668313","96761700619096618848155424877440766761","189116575807094363591366435158005966733","328972065659609515449903681800767817530","124001646450130646597883712396639582804","220092803313931249191728724405364258294","313884598129295821318254834020405786783","171477217269564886420280415011240621420","304609134152064559331896799232461505428","44334415639866182448904069555787731304","13101529609456087772061211944953593731","128089194807695572193436054687926546239","130016030095310468751148087440882521442","111529647740625874778412231023084165236","15665211555862239654564032919617031251","121654835249428495105171595832884077131","275953889368401565801347847412798495698","73262870118538731218372341833784479610","126743597959871658982247599010344181523","248171407908208369010609983352983062338","172953441490949274913567314543701753999","140857833163224061964480958720255016138","194562109019678823586281164387647915884","240061888695720363480990928901474093441","15050384229347330882190595505260432698","41911509262685000058609037927424188467","183505341681162840887043258266762722676","56841954995059136350083634130817672323","167962845478524219971443179600387861875","218754870157066123971141027565514623947","313884598129295821318254834020405786783","171477217269564886420280415011240621420","301817577172208892801417505418775749914","318277816377760811693794761983749823048","130061015004572872382407782439019462708","42772226266753665223320679633572016802","280361349094179746363783213432919879107","231534633000550152706549543198681465250","126743597959871658982247599010344181523","248171407908208369010609983352983062338","172953441490949274913567314543701753999","140857833163224061964480958720255016138","194562109019678823586281164387647915884","240061888695720363480990928901474093441","15050384229347330882190595505260432698","41911509262685000058609037927424188467","110759802393442781113245592673950237705","123058376811462034367472942468248726987","220816912679677442317878847876078272311","315506868766480092556933606801775353766","287541147080965347363400983322204962461","165709385601119425581269462911437445468","94230026174649219753708832309813113966","258702328502958531430404831104204330819","231534633000550152706549543198681465250","126743597959871658982247599010344181523","248171407908208369010609983352983062338","172953441490949274913567314543701753999","140857833163224061964480958720255016138","194562109019678823586281164387647915884","240061888695720363480990928901474093441","15050384229347330882190595505260432698","41911509262685000058609037927424188467","110759802393442781113245592673950237705","193757125760454097576730339236017154027","38153323729235186869274654555656774644","62777079112811381515586445868929292083","181682494023817716880860490886845682783"],"threshold":0.9},"id":"CVE-2024-6895-bcb0109a","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5","target":{"file":"managed/src/main/java/com/yugabyte/yw/rbac/handlers/AuthorizationHandler.java","function":"call"},"deprecated":false,"digest":{"function_hash":"264877559524461301017044237346310753764","length":4620},"id":"CVE-2024-6895-be97ae09","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"190714551927322160221311875844651955745","length":948},"id":"CVE-2024-6895-c9355a19","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5","target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java","function":"changePassword"}},{"digest":{"function_hash":"1593727489807992895213882843181890172","length":1035},"id":"CVE-2024-6895-cb80e9b1","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5","target":{"file":"managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java","function":"testUpdateUserProfileReadOnlyUserPasswordChange"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5","target":{"file":"managed/src/main/java/com/yugabyte/yw/rbac/enums/SourceType.java"},"deprecated":false,"digest":{"line_hashes":["148019195298962974478109671488255960508","310788564351638500113741915580266158527","66489017476295525245883889434541144272","336010409380679558390623948530932094942"],"threshold":0.9},"id":"CVE-2024-6895-d33b4da1"},{"target":{"file":"managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java","function":"testUpdateUserProfileInvalid"},"deprecated":false,"digest":{"function_hash":"256100060117917028273018669911643959720","length":1054},"id":"CVE-2024-6895-e1abc335","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5"},{"id":"CVE-2024-6895-e7d27280","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5","target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java","function":"updateProfile"},"deprecated":false,"digest":{"length":2700,"function_hash":"195956668031822345634895062922387307734"}},{"target":{"file":"managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java","function":"testPasswordChangeValid"},"deprecated":false,"digest":{"length":932,"function_hash":"167511153861672024083424184284089076388"},"id":"CVE-2024-6895-efc9018f","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H"}]}