{"id":"CVE-2024-6908","summary":"Admin Can Escalate Privileges to SuperAdmin Using Manual PUT Request","details":"Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potentially leading to unauthorized access to sensitive system functions and data.","modified":"2026-10-28T10:51:27.671298136Z","published":"2024-07-19T14:57:00.607Z","database_specific":{"cwe_ids":["CWE-269"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6908.json","cna_assigner":"Yugabyte"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6908.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6908"},{"type":"FIX","url":"https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662"},{"type":"FIX","url":"https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yugabyte/yugabyte-db","events":[{"introduced":"ca570194beaf8b2c4f352930e3262c0a34cb9c6a"},{"last_affected":"fee5dbf3e057674e09c96020a8faa17e0ffc60ec"},{"introduced":"1cb99f52bd7dd7a95de0a94b6c20aa94b1ef52ff"},{"last_affected":"d2093e2bf3ae09011912e1c48f7ab979b0ed5bde"},{"introduced":"c29ea61fcda1ee975bad57db8a69ba4349c363c4"},{"fixed":"cf96d182fcd2c7a72841936b9352b27b6df39594"},{"introduced":"0026607ed49516b4d5770f5479dd5d60d44710af"},{"fixed":"05ceb5b37b5f1c25a4216dfdbad14769541e71c8"},{"fixed":"03b193de40b79329439bb9968a7d27a1cc57d662"},{"fixed":"68f01680c565be2a370cfb7734a1b3721d6778bb"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"2.14.0.0"},{"last_affected":"2.14.17.0"}]},{"strategy":"StandardRange","range":[{"introduced":"2.16.0.0"},{"last_affected":"2.16.9.0"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"2.18.0.0"},{"fixed":"2.18.7.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"2.20.0.0"},{"fixed":"2.20.3.0"}]},{"range":[{"fixed":"03b193de40b79329439bb9968a7d27a1cc57d662"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"68f01680c565be2a370cfb7734a1b3721d6778bb"}]}]}}],"versions":["v2.14.17.0","v2.14.16.0","v2.16.9.0","v2.14.15.0","v2.14.14.0","v2.14.13.0","v2.16.7.0","v2.14.12.0","v2.16.6.0","v2.14.11.0","v2.16.5.0","v2.14.10.0","v2.16.4.0","v2.16.3.0","v2.14.8.0","v2.14.7.0","v2.14.5.0","v2.14.6.0","v2.16.0.0","v2.14.4.0","v2.14.0.0","v2.14.2.0","v2.14.3.0","v2.14.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6908.json","vanir_signatures":[{"id":"CVE-2024-6908-0ee488bc","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb","target":{"file":"managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["23136404727938099402094247942867305506","268109784697180586888374699270357321183","170928423322184071298563136088902474222","326561129504036851046669166642755468371","298104032484539792911617455937168306915","149115523116181273154637434622715853811"]}},{"target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/YbcController.java"},"deprecated":false,"digest":{"line_hashes":["38386941464383662547969588584889867108","50540687600443760669488047591215787241","73952081617020963097355328443176244596","70935220895179637138702705709145497838"],"threshold":0.9},"id":"CVE-2024-6908-2d2f8719","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb"},{"digest":{"function_hash":"9270452990139907395854376270891003847","length":406},"id":"CVE-2024-6908-4157cef5","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/fs/fs_manager.cc","function":"FsManager::SetUniverseUuidOnTserverInstanceMetadata"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["79064002415265059393588741746696376430","98364597092808119132528313496454430681","319542160979610774972785955666237474084"],"threshold":0.9},"id":"CVE-2024-6908-44343954","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/fs/fs_manager.h"}},{"digest":{"threshold":0.9,"line_hashes":["139370573945451618663885754161498715223","266623607083603784050938695114972981634","130112624142382789937209244321844834115","307040615518753913927498010386376339681","98944768063746834533446407501667324937","289851302489464650630122245561967978198","253996709970718046949717604850777391030"]},"id":"CVE-2024-6908-45324a05","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/tserver/tablet_server.cc"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/master/catalog_manager.cc","function":"CatalogManager::SetUniverseUuidIfNeeded"},"deprecated":false,"digest":{"function_hash":"277817556653446693388553253257621341237","length":704},"id":"CVE-2024-6908-463dd6ec"},{"id":"CVE-2024-6908-52ea7749","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/integration-tests/master_heartbeat-itest.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["260640685449145077670956618448490194240","132824703554761486526082841411616587553","3443303361738249408599957621375235887","65170522159532932319435228005564881956","276466283208890082659457936155447628434","76155869858041626792071782866587021185"]}},{"target":{"file":"src/yb/master/sys_catalog-test.cc","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"95961142753903333428026998788644242502","length":3363},"id":"CVE-2024-6908-5ee9846c","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594"},{"digest":{"length":1183,"function_hash":"87232531819426965628236045872743977435"},"id":"CVE-2024-6908-757f5512","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/tools/ts-cli.cc","function":"SetUsage"},"deprecated":false},{"source":"https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb","target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java"},"deprecated":false,"digest":{"line_hashes":["192138964171095151355969977394648803083","59000782050820667527649063845504079851","336975985142418399781436410193887473031","242754815263414101816362273782782127834","127488467474057792402601833945847662623","152409963728829890162000095304891851384","102364447443960591539983625131565300172"],"threshold":0.9},"id":"CVE-2024-6908-834faede","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"290251985707263117975818033644792522846","length":1242},"id":"CVE-2024-6908-83d97e14","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb","target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java","function":"changeRole"}},{"deprecated":false,"digest":{"line_hashes":["164495929955642430828837642071415873989","87463839579780457734909665572224221610","86381345174084607859049864578468158582"],"threshold":0.9},"id":"CVE-2024-6908-8ca12db1","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/tserver/tablet_server.h"}},{"source":"https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662","target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java"},"deprecated":false,"digest":{"line_hashes":["192138964171095151355969977394648803083","150185239929966929246043502681959992876","48249719473128898346638968896278204201","93583001150838198363284357834164625722","240980066450593003092558615534753796318","30872787694841923490617795693088377474","306130394003671881438949679276819739079"],"threshold":0.9},"id":"CVE-2024-6908-96bccd8f","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"218473803069175361052691556291027949332","length":2957},"id":"CVE-2024-6908-adaa09bc","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/68f01680c565be2a370cfb7734a1b3721d6778bb","target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java","function":"create"}},{"target":{"file":"src/yb/fs/fs_manager.cc"},"deprecated":false,"digest":{"line_hashes":["244315558011444723468404636653350565339","70875866439291314909591040235641565812","284595706535117114524245614984802277874","53192008597845094654033988643726168814","211021415317124669363365284812746656915","238488733120132698072186591030819310729","81783550171452274380889987762078739077","211204257335434772337976447903112175805","275236482796160002546865249970365077129"],"threshold":0.9},"id":"CVE-2024-6908-bb18e6a8","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594"},{"source":"https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662","target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java","function":"changeRole"},"deprecated":false,"digest":{"length":650,"function_hash":"181171011168389764701270601946922006677"},"id":"CVE-2024-6908-be44e612","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/tools/ts-cli.cc"},"deprecated":false,"digest":{"line_hashes":["237354429522577044109177494101787548941","211400997372667413658660421849401714430","7133332097966779782481100755711308007","338239631061912920350906014855611733757","228765431152618453605020712729360338103","296366503107908755615771344440913724399","114351513282617695254676020735441014767","224948002099062506411862384109185122223","214670557192743591551153465664582942632","110567995294505134054185098562114171049","220914419148803242151606760579397657598","1593809192819880733474099111634633234","266184935541897566748098815944626231482","138750627289315847641348234367167840754","252936309955370085402885239398214513676","10613355082481775305842507758982500740","215299388318682120168952217358615033703","198123905481304552070349082088112060974","339377125428957676059174134929630457731","51048856595926066447518854995018081435","230294185195687736903955554157525849313","9655602661891619682567075501288542781","98592675390803068331182981134023498644","333215751472926717017449411521464579315","25406459370583947178045103367823973531"],"threshold":0.9},"id":"CVE-2024-6908-c1d06980","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662","target":{"file":"managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java"},"deprecated":false,"digest":{"line_hashes":["23136404727938099402094247942867305506","268109784697180586888374699270357321183","170928423322184071298563136088902474222","326561129504036851046669166642755468371","298104032484539792911617455937168306915","149115523116181273154637434622715853811"],"threshold":0.9},"id":"CVE-2024-6908-c584c740"},{"signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/master/sys_catalog-test.cc"},"deprecated":false,"digest":{"line_hashes":["300041116249514024298695713106473501197","92498842114088335956793540979786687449","115859639279101588559625599082728542789","206337709066049007216836975830535928846"],"threshold":0.9},"id":"CVE-2024-6908-cd290669","signature_type":"Line"},{"target":{"file":"src/yb/master/catalog_manager.cc"},"deprecated":false,"digest":{"line_hashes":["94472313349444251696714769942989402502","175825328096078340581831539718526510924","322761239142309100645111905894868041194","177167192139262970439819002295802385343","299849889133132905186726729443974644185","76700672274358858010896070746857971442","116222538556369132130942505520687518005"],"threshold":0.9},"id":"CVE-2024-6908-d68cde28","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662","target":{"file":"managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java","function":"create"},"deprecated":false,"digest":{"function_hash":"147296581769899178307756026745589266932","length":1127},"id":"CVE-2024-6908-d87757c9"},{"target":{"function":"CatalogManager::SetClusterConfig","file":"src/yb/master/catalog_manager.cc"},"deprecated":false,"digest":{"length":2649,"function_hash":"266280605175838146786601932960805018943"},"id":"CVE-2024-6908-deca5fd0","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594"},{"id":"CVE-2024-6908-e0bc37eb","signature_type":"Function","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/tools/ts-cli.cc","function":"TsCliMain"},"deprecated":false,"digest":{"function_hash":"79224146666083883082301530431690074110","length":5793}},{"digest":{"threshold":0.9,"line_hashes":["188143512696110015370400684649044834049","179704887801823849469219318249574214559","67192419256964213198543097717480413632"]},"id":"CVE-2024-6908-feb3b8f3","signature_type":"Line","signature_version":"v1","source":"https://github.com/yugabyte/yugabyte-db/commit/cf96d182fcd2c7a72841936b9352b27b6df39594","target":{"file":"src/yb/tserver/tablet_service.h"},"deprecated":false}],"vanir_signatures_modified":"2026-10-28T10:51:27Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H"}]}