CVE-2024-43784

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit all of the previous user's credentials. This issue has been addressed in release version 1.33.0 and all users are advised to upgrade. The only known workaround for those who cannot upgrade is to not reuse usernames.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L

Weakness enumeration

CWE-281

Affected software

No affected versions have been published.

Timeline

Published: Nov 26, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-437852.5gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the CVE-2024-437875.0Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Con CVE-2024-437886.1Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, CVE-2024-437894.3Discourse is an open source platform for community discussion. A user can create a post with many replies, and then attempt to fetch them al CVE-2024-43795.4The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Global Tooltip widget in CVE-2024-437905.5Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), CVE-2024-437917.8RequestStore provides per-request global storage for Rack. The files published as part of request_store 1.3.2 have 0666 permissions, meaning CVE-2024-437926.1Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. CVE-2024-437936.4Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. CVE-2024-437946.1OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Impr CVE-2024-437956.1OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. The login functional CVE-2024-437964.7Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.red