CVE-2024-6908

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potentially leading to unauthorized access to sensitive system functions and data.

Metrics

CVSS 4.0 6.0/10

CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
YugabyteDB	YugabyteDB Anywhere	>= 2.14.0.0, <= 2.14.17.0; >= 2.16.0.0, <= 2.16.9.0; >= 2.18.0.0, < 2.18.7.0; >= 2.20.0.0, < 2.20.3.0
yugabytedb	yugabytedb_anywhere	>= 2.14.0.0, <= 2.14.17.0; >= 2.16.0.0, <= 2.16.9.0; >= 2.18.0.0, < 2.18.7.0; >= 2.20.0.0, < 2.20.3.0

References

Timeline

Published: Jul 19, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-69104.8The EventON WordPress plugin before 2.2.17 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2024-69117.5Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPl CVE-2024-69129.8Use of hard-coded MSSQL credentials in PerkinElmer ProcessPlus on Windows allows an attacker to login remove on all prone installations.This CVE-2024-69138.8Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue CVE-2024-69149.8An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP CVE-2024-69159.3JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Vali CVE-2024-69165.5A vulnerability in Zowe CLI allows local, privileged actors to display securely stored properties in cleartext within a terminal using the 'CVE-2024-69179.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Veribilim Software Veribase Orde CVE-2024-69187.5CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause a crash of the Accutec CVE-2024-69199.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NAC CVE-2024-69206.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NAC Telecommunication Systems Inc. NAC CVE-2024-69217.5Cleartext Storage of Sensitive Information vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Retrieve Embedded Sensitive