CVE-2024-22047

LowCVSS 3.1/10Last modified Oct 29, 2026

Description

A race condition exists in Audited 4.0.0 before 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
—	—	>= 4.0.0, < 5.3.3

References

https://github.com/advisories/GHSA-hjp3-5g2q-7jwwThird Party Advisory
https://github.com/collectiveidea/audited/issues/601Issue Tracking, Patch, Vendor Advisory
https://github.com/collectiveidea/audited/pull/669Patch
https://github.com/collectiveidea/audited/pull/671Patch
https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jwwVendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-hjp3-5g2q-7jwwThird Party Advisory
https://github.com/advisories/GHSA-hjp3-5g2q-7jwwThird Party Advisory
https://github.com/collectiveidea/audited/issues/601Issue Tracking, Patch, Vendor Advisory
https://github.com/collectiveidea/audited/pull/669Patch
https://github.com/collectiveidea/audited/pull/671Patch
https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jwwVendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-hjp3-5g2q-7jwwThird Party Advisory

Timeline

Published: Jan 4, 2024
Last modified: Oct 29, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-220486.1govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be exec CVE-2024-220495.3httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide CVE-2024-220507.5Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the pu CVE-2024-220519.8CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenti CVE-2024-220527.5A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthen CVE-2024-220538.2A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated mal CVE-2024-220547.5A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device ma CVE-2024-220587.8A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated CVE-2024-220598.8A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/modify/delete informati CVE-2024-22066.5An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the `/proxy` route. Attackers CVE-2024-220604.9An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, high privileged user t CVE-2024-220619.8A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to ex