{"id":"CVE-2024-6908","summary":"Admin Can Escalate Privileges to SuperAdmin Using Manual PUT Request","details":"Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potentially leading to unauthorized access to sensitive system functions and data.","modified":"2026-08-12T15:13:14.118784Z","published":"2024-07-19T14:57:00.607Z","database_specific":{"cna_assigner":"Yugabyte","cwe_ids":["CWE-269"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6908.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6908.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6908"},{"type":"FIX","url":"https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662"},{"type":"FIX","url":"https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yugabyte/yugabyte-db","events":[{"introduced":"ca570194beaf8b2c4f352930e3262c0a34cb9c6a"},{"introduced":"1cb99f52bd7dd7a95de0a94b6c20aa94b1ef52ff"},{"introduced":"c29ea61fcda1ee975bad57db8a69ba4349c363c4"},{"introduced":"0026607ed49516b4d5770f5479dd5d60d44710af"},{"fixed":"cf96d182fcd2c7a72841936b9352b27b6df39594"},{"fixed":"05ceb5b37b5f1c25a4216dfdbad14769541e71c8"},{"fixed":"03b193de40b79329439bb9968a7d27a1cc57d662"},{"fixed":"68f01680c565be2a370cfb7734a1b3721d6778bb"}],"database_specific":{"extracted_events":[{"introduced":"2.14.0.0"},{"last_affected":"2.14.17.0"},{"introduced":"2.16.0.0"},{"last_affected":"2.16.9.0"},{"introduced":"2.18.0.0"},{"fixed":"2.18.7.0"},{"introduced":"2.20.0.0"},{"fixed":"2.20.3.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6908.json","vanir_signatures_modified":"2026-08-12T15:13:14Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb","target":{"file":"managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java"},"deprecated":false,"digest":{"line_hashes":["23136404727938099402094247942867305506","268109784697180586888374699270357321183","170928423322184071298563136088902474222","326561129504036851046669166642755468371","298104032484539792911617455937168306915","149115523116181273154637434622715853811"],"threshold":0.9},"id":"CVE-2024-6908-0ee488bc"},{"signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb","target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/YbcController.java"},"deprecated":false,"digest":{"line_hashes":["38386941464383662547969588584889867108","50540687600443760669488047591215787241","73952081617020963097355328443176244596","70935220895179637138702705709145497838"],"threshold":0.9},"id":"CVE-2024-6908-2d2f8719","signature_type":"Line"},{"digest":{"function_hash":"9270452990139907395854376270891003847","length":406},"id":"CVE-2024-6908-4157cef5","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/fs/fs_manager.cc","function":"FsManager::SetUniverseUuidOnTserverInstanceMetadata"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["79064002415265059393588741746696376430","98364597092808119132528313496454430681","319542160979610774972785955666237474084"],"threshold":0.9},"id":"CVE-2024-6908-44343954","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/fs/fs_manager.h"}},{"digest":{"line_hashes":["139370573945451618663885754161498715223","266623607083603784050938695114972981634","130112624142382789937209244321844834115","307040615518753913927498010386376339681","98944768063746834533446407501667324937","289851302489464650630122245561967978198","253996709970718046949717604850777391030"],"threshold":0.9},"id":"CVE-2024-6908-45324a05","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/tserver/tablet_server.cc"},"deprecated":false},{"id":"CVE-2024-6908-463dd6ec","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/master/catalog_manager.cc","function":"CatalogManager::SetUniverseUuidIfNeeded"},"deprecated":false,"digest":{"function_hash":"277817556653446693388553253257621341237","length":704}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/integration-tests/master_heartbeat-itest.cc"},"deprecated":false,"digest":{"line_hashes":["260640685449145077670956618448490194240","132824703554761486526082841411616587553","3443303361738249408599957621375235887","65170522159532932319435228005564881956","276466283208890082659457936155447628434","76155869858041626792071782866587021185"],"threshold":0.9},"id":"CVE-2024-6908-52ea7749"},{"deprecated":false,"digest":{"function_hash":"95961142753903333428026998788644242502","length":3363},"id":"CVE-2024-6908-5ee9846c","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/master/sys_catalog-test.cc","function":"TEST_F"}},{"target":{"file":"src/yb/tools/ts-cli.cc","function":"SetUsage"},"deprecated":false,"digest":{"function_hash":"87232531819426965628236045872743977435","length":1183},"id":"CVE-2024-6908-757f5512","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594"},{"target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java"},"deprecated":false,"digest":{"line_hashes":["192138964171095151355969977394648803083","59000782050820667527649063845504079851","336975985142418399781436410193887473031","242754815263414101816362273782782127834","127488467474057792402601833945847662623","152409963728829890162000095304891851384","102364447443960591539983625131565300172"],"threshold":0.9},"id":"CVE-2024-6908-834faede","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb"},{"deprecated":false,"digest":{"function_hash":"290251985707263117975818033644792522846","length":1242},"id":"CVE-2024-6908-83d97e14","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb","target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java","function":"changeRole"}},{"signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/tserver/tablet_server.h"},"deprecated":false,"digest":{"line_hashes":["164495929955642430828837642071415873989","87463839579780457734909665572224221610","86381345174084607859049864578468158582"],"threshold":0.9},"id":"CVE-2024-6908-8ca12db1","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662","target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java"},"deprecated":false,"digest":{"line_hashes":["192138964171095151355969977394648803083","150185239929966929246043502681959992876","48249719473128898346638968896278204201","93583001150838198363284357834164625722","240980066450593003092558615534753796318","30872787694841923490617795693088377474","306130394003671881438949679276819739079"],"threshold":0.9},"id":"CVE-2024-6908-96bccd8f","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"218473803069175361052691556291027949332","length":2957},"id":"CVE-2024-6908-adaa09bc","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb","target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java","function":"create"}},{"id":"CVE-2024-6908-bb18e6a8","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/fs/fs_manager.cc"},"deprecated":false,"digest":{"line_hashes":["244315558011444723468404636653350565339","70875866439291314909591040235641565812","284595706535117114524245614984802277874","53192008597845094654033988643726168814","211021415317124669363365284812746656915","238488733120132698072186591030819310729","81783550171452274380889987762078739077","211204257335434772337976447903112175805","275236482796160002546865249970365077129"],"threshold":0.9}},{"target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java","function":"changeRole"},"deprecated":false,"digest":{"function_hash":"181171011168389764701270601946922006677","length":650},"id":"CVE-2024-6908-be44e612","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["237354429522577044109177494101787548941","211400997372667413658660421849401714430","7133332097966779782481100755711308007","338239631061912920350906014855611733757","228765431152618453605020712729360338103","296366503107908755615771344440913724399","114351513282617695254676020735441014767","224948002099062506411862384109185122223","214670557192743591551153465664582942632","110567995294505134054185098562114171049","220914419148803242151606760579397657598","1593809192819880733474099111634633234","266184935541897566748098815944626231482","138750627289315847641348234367167840754","252936309955370085402885239398214513676","10613355082481775305842507758982500740","215299388318682120168952217358615033703","198123905481304552070349082088112060974","339377125428957676059174134929630457731","51048856595926066447518854995018081435","230294185195687736903955554157525849313","9655602661891619682567075501288542781","98592675390803068331182981134023498644","333215751472926717017449411521464579315","25406459370583947178045103367823973531"]},"id":"CVE-2024-6908-c1d06980","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/tools/ts-cli.cc"}},{"signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662","target":{"file":"managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java"},"deprecated":false,"digest":{"line_hashes":["23136404727938099402094247942867305506","268109784697180586888374699270357321183","170928423322184071298563136088902474222","326561129504036851046669166642755468371","298104032484539792911617455937168306915","149115523116181273154637434622715853811"],"threshold":0.9},"id":"CVE-2024-6908-c584c740","signature_type":"Line"},{"target":{"file":"src/yb/master/sys_catalog-test.cc"},"deprecated":false,"digest":{"line_hashes":["300041116249514024298695713106473501197","92498842114088335956793540979786687449","115859639279101588559625599082728542789","206337709066049007216836975830535928846"],"threshold":0.9},"id":"CVE-2024-6908-cd290669","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594"},{"deprecated":false,"digest":{"line_hashes":["94472313349444251696714769942989402502","175825328096078340581831539718526510924","322761239142309100645111905894868041194","177167192139262970439819002295802385343","299849889133132905186726729443974644185","76700672274358858010896070746857971442","116222538556369132130942505520687518005"],"threshold":0.9},"id":"CVE-2024-6908-d68cde28","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/master/catalog_manager.cc"}},{"target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java","function":"create"},"deprecated":false,"digest":{"function_hash":"147296581769899178307756026745589266932","length":1127},"id":"CVE-2024-6908-d87757c9","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662"},{"deprecated":false,"digest":{"function_hash":"266280605175838146786601932960805018943","length":2649},"id":"CVE-2024-6908-deca5fd0","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/master/catalog_manager.cc","function":"CatalogManager::SetClusterConfig"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/tools/ts-cli.cc","function":"TsCliMain"},"deprecated":false,"digest":{"function_hash":"79224146666083883082301530431690074110","length":5793},"id":"CVE-2024-6908-e0bc37eb"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/tserver/tablet_service.h"},"deprecated":false,"digest":{"line_hashes":["188143512696110015370400684649044834049","179704887801823849469219318249574214559","67192419256964213198543097717480413632"],"threshold":0.9},"id":"CVE-2024-6908-feb3b8f3"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H"}]}