Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and access to application can modify settings such as password and email without being prompted for the current password, enabling account takeover.
[
    {
        "signature_version": "v1",
        "digest": {
            "length": 890.0,
            "function_hash": "238964373452549663257251932304738075087"
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-169284c8",
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java",
            "function": "testUpdateUserProfileValidOnlyPassword"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 778.0,
            "function_hash": "143555286364527243140061390472701025452"
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-1e0cccb2",
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java",
            "function": "testPasswordChangeInvalidPassword"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 1073.0,
            "function_hash": "149133980081874155652305980922866881535"
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-24357a1c",
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java",
            "function": "testUpdateUserProfileNullifyTimezone"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 1111.0,
            "function_hash": "194835205870919087484785019312383074235"
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-57e14abf",
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java",
            "function": "testUpdateUserProfileValid"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "221954258843129905092461824339088703488",
                "189055111379491193824982451105330234672",
                "296868805285795244603188251743167261393",
                "139991841111366215294450660057197677579",
                "324566051529180370493810080138063837343",
                "17494261785147379361842817287472465512",
                "20522370051166458158050488280298230053",
                "244515948328907504651681440880947434290",
                "140022381546428663102301106445049229359",
                "80544288545216299503154082108437567418",
                "93421919138892481068406024939468630916",
                "301413765618320360323394464386563057143",
                "334244901324713293601244956970699021821",
                "137473671738508866631489410991256528605",
                "308995948438744566838744759763475017398",
                "61707086101852707243700754116331255876",
                "278032983532089276082340558142368681409",
                "32114590439602919276836430300407682942",
                "92940421073132649787057308294222826047",
                "4963522875977362775434220524510814872",
                "155346094285145684677138253307536163654",
                "18109905741285251012175914807313051249",
                "172397210954310268230949611838121246002",
                "138532111079202085851949190709513462243"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-9b212c9a",
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "managed/src/main/java/com/yugabyte/yw/rbac/handlers/AuthorizationHandler.java"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "26321677373176286356460168310404404924",
                "38029626468336420718574741806170635640",
                "62553867366308554820558356078978096774",
                "192150148749309895819672499616724345515"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-9cd5fb00",
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "managed/src/main/java/com/yugabyte/yw/common/RedactingService.java"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 259.0,
            "function_hash": "36262955468535495196093791459001094786"
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-a18848b3",
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java",
            "function": "setUp"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "326415609636096164901291895346679064680",
                "298152909351094244796869867757858602913",
                "128512709214130369533833023104096788026",
                "159532982956982250735847366349459063191",
                "26419059889531928922932627294133641543",
                "297846214686697129386226114145077970168",
                "46097254031552621874132827133783071695",
                "185866354728001036161656366776396371611",
                "251875045896436925334071535604128541068",
                "175493583298614036217158563834079372981",
                "199923582412401960442889247622350927364",
                "335703851974337726036396115035609152037",
                "292557168745466521140154416368891193261",
                "261087039907919605957749581356859360725",
                "191653986073340560251743109776924569716",
                "68643866534324391027260581395431230015",
                "255723323192999641919612041561007333514",
                "261134172649569442466723027818612155037",
                "248666839776606506435280356724817325364",
                "10585987604019295945311538670147365463",
                "82531610282056918855813950275795325797",
                "231775534482322771493235955544555262188",
                "297944956211191018901874741811339991327",
                "49183759075512775593987441521955554551",
                "171301227671100890109977340405702618449",
                "7181375929154412362108942031410514285",
                "151290630918516271496192746529847537505",
                "245963785967892417711114914051628966653",
                "327814501393872007483181465246755986115",
                "338277499625139139344495605701732563296",
                "154888016761659538920370820179284260968",
                "277919677742684730440057771326309021420",
                "148951148463620034320853993741541093178",
                "78907833474055895116843771169278874746",
                "96991896219440762605384190476786123336",
                "196231316704569454178454370154924313789",
                "125571193865282501578148937267913441131",
                "103731371960293352906917190408509755110",
                "116098005551718557055260608735187183242",
                "84014681734988156499325043630304280024",
                "95061489157951142259157201239268852377",
                "97282262417947906755511006747359411067",
                "258414524541643706957974892254812298861",
                "283106770642912082463458828992015783613",
                "298333857478925737009663276478300445855",
                "138091800922334408301901177506854663525",
                "251677730246463453326789307825386544155",
                "304182955349005931526488481122326884148",
                "133708970437109974660349379886236699709",
                "337698393293564631379616829356406437198",
                "15963932301687891669892805775407076575",
                "21600314893138716996607819098891167397",
                "189316960305257622392921843645347730866",
                "189921456224339442461066912811897678704",
                "1048106638043349438675702840383728173",
                "168800700335205717804123977501224852430",
                "338941496630847652935932625716753464829",
                "237722828634425176750920727542483824376",
                "154888016761659538920370820179284260968",
                "277919677742684730440057771326309021420",
                "148951148463620034320853993741541093178",
                "78907833474055895116843771169278874746",
                "239575283920097119536470724121465356417",
                "187642849992065728781255104329830261403",
                "182796925872711245324699100454653441358",
                "285440981131593004559891448541675018372",
                "14092248491599145272017974681645365148",
                "74750732002684589526133006443447089460",
                "173214807145808808336209340238746893459",
                "10354451427533759736669511146476862388",
                "316755477883378178425165759304972546109",
                "96528121339453985006561069102411635843",
                "288360187849311759026212698235368614904",
                "25897477046009780195706251522465118742"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-aa2a1b09",
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 872.0,
            "function_hash": "18703274237619741009699678654879260194"
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-b4af64a0",
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java",
            "function": "testUpdateUserProfileInvalidPassword"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "120005149001946206336292075069416215719",
                "70162802048050543570222152913330425986",
                "144554300580073787425822542163490623393",
                "48561982941994781370378052192437687742",
                "52701455977616860875344428526499740579",
                "198686944104796747411086114931676874646",
                "208484704621978464385359701990470252500",
                "333752982196500653570419344445311049950",
                "168634041682837025806706475448842919757",
                "294518181494534257463470022366507489981",
                "325905825988335201815848335344005158712",
                "309129141571898273528199442075610792296",
                "246088298842752267679530471006695065357",
                "36766503988661380382767941572048777491",
                "135335270848263168321169580464049387995",
                "280793010126232641662236906692956681410",
                "183295225560929702679727435707684937296",
                "180799156496038172686381461079301175520",
                "12206569784226528800882937745899456366",
                "319791092344380087031542596190005711841",
                "236181823625831979533593714370239516746",
                "323611132058094499718937617691414348866",
                "81159629577926444449043232782702484675",
                "279675769329626192583100833132277454893",
                "340168000552593114678315444410239016544",
                "113334341574853545472333378085102694595",
                "117154095003035199201049243164294454079",
                "167892399770306782513724771096901386370",
                "126743597959871658982247599010344181523",
                "248171407908208369010609983352983062338",
                "172953441490949274913567314543701753999",
                "308629593316627906199208503610232168730",
                "122684635699485832698967289565752578596",
                "56805441029399141595933279327415758747",
                "236062607395241103309639091709637807769",
                "41911509262685000058609037927424188467",
                "258743697711810721188101579962548302934",
                "310439047633909144813053540216446384617",
                "263284034739401755304947987564800236037",
                "69931212808607448803531976690202200883",
                "159556733443648651777686498302515150279",
                "90501127774193579057111049370308139263",
                "219805546601402629942328490516022489295",
                "296325593552383293327124738726107903046",
                "185473631073050484188673037394052463997",
                "227630491840200224225452306515879373687",
                "13101529609456087772061211944953593731",
                "179597753108268786536772706952068227761",
                "337292538108660914171845829977241476067",
                "50263169224006444012195800335519632270",
                "68206322126359521449588736313859181760",
                "119899699267688717964441449453312405634",
                "238640467854102309115013416957739517978",
                "172953441490949274913567314543701753999",
                "308629593316627906199208503610232168730",
                "122684635699485832698967289565752578596",
                "56805441029399141595933279327415758747",
                "207733675205603154851065465904418453724",
                "287541147080965347363400983322204962461",
                "165709385601119425581269462911437445468",
                "94230026174649219753708832309813113966",
                "275364588437779057751547890834654885417",
                "128089194807695572193436054687926546239",
                "130016030095310468751148087440882521442",
                "111529647740625874778412231023084165236",
                "95104020226363816307381025407163441521",
                "11677221610751472877848758368607668313",
                "96761700619096618848155424877440766761",
                "189116575807094363591366435158005966733",
                "328972065659609515449903681800767817530",
                "124001646450130646597883712396639582804",
                "220092803313931249191728724405364258294",
                "313884598129295821318254834020405786783",
                "171477217269564886420280415011240621420",
                "304609134152064559331896799232461505428",
                "44334415639866182448904069555787731304",
                "13101529609456087772061211944953593731",
                "128089194807695572193436054687926546239",
                "130016030095310468751148087440882521442",
                "111529647740625874778412231023084165236",
                "15665211555862239654564032919617031251",
                "121654835249428495105171595832884077131",
                "275953889368401565801347847412798495698",
                "73262870118538731218372341833784479610",
                "126743597959871658982247599010344181523",
                "248171407908208369010609983352983062338",
                "172953441490949274913567314543701753999",
                "140857833163224061964480958720255016138",
                "194562109019678823586281164387647915884",
                "240061888695720363480990928901474093441",
                "15050384229347330882190595505260432698",
                "41911509262685000058609037927424188467",
                "183505341681162840887043258266762722676",
                "56841954995059136350083634130817672323",
                "167962845478524219971443179600387861875",
                "218754870157066123971141027565514623947",
                "313884598129295821318254834020405786783",
                "171477217269564886420280415011240621420",
                "301817577172208892801417505418775749914",
                "318277816377760811693794761983749823048",
                "130061015004572872382407782439019462708",
                "42772226266753665223320679633572016802",
                "280361349094179746363783213432919879107",
                "231534633000550152706549543198681465250",
                "126743597959871658982247599010344181523",
                "248171407908208369010609983352983062338",
                "172953441490949274913567314543701753999",
                "140857833163224061964480958720255016138",
                "194562109019678823586281164387647915884",
                "240061888695720363480990928901474093441",
                "15050384229347330882190595505260432698",
                "41911509262685000058609037927424188467",
                "110759802393442781113245592673950237705",
                "123058376811462034367472942468248726987",
                "220816912679677442317878847876078272311",
                "315506868766480092556933606801775353766",
                "287541147080965347363400983322204962461",
                "165709385601119425581269462911437445468",
                "94230026174649219753708832309813113966",
                "258702328502958531430404831104204330819",
                "231534633000550152706549543198681465250",
                "126743597959871658982247599010344181523",
                "248171407908208369010609983352983062338",
                "172953441490949274913567314543701753999",
                "140857833163224061964480958720255016138",
                "194562109019678823586281164387647915884",
                "240061888695720363480990928901474093441",
                "15050384229347330882190595505260432698",
                "41911509262685000058609037927424188467",
                "110759802393442781113245592673950237705",
                "193757125760454097576730339236017154027",
                "38153323729235186869274654555656774644",
                "62777079112811381515586445868929292083",
                "181682494023817716880860490886845682783"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-bcb0109a",
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 4620.0,
            "function_hash": "264877559524461301017044237346310753764"
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-be97ae09",
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "managed/src/main/java/com/yugabyte/yw/rbac/handlers/AuthorizationHandler.java",
            "function": "call"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 948.0,
            "function_hash": "190714551927322160221311875844651955745"
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-c9355a19",
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java",
            "function": "changePassword"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 1035.0,
            "function_hash": "1593727489807992895213882843181890172"
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-cb80e9b1",
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java",
            "function": "testUpdateUserProfileReadOnlyUserPasswordChange"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "148019195298962974478109671488255960508",
                "310788564351638500113741915580266158527",
                "66489017476295525245883889434541144272",
                "336010409380679558390623948530932094942"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-d33b4da1",
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "managed/src/main/java/com/yugabyte/yw/rbac/enums/SourceType.java"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 1054.0,
            "function_hash": "256100060117917028273018669911643959720"
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-e1abc335",
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java",
            "function": "testUpdateUserProfileInvalid"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 2700.0,
            "function_hash": "195956668031822345634895062922387307734"
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-e7d27280",
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "managed/src/main/java/com/yugabyte/yw/controllers/UsersController.java",
            "function": "updateProfile"
        }
    },
    {
        "signature_version": "v1",
        "digest": {
            "length": 932.0,
            "function_hash": "167511153861672024083424184284089076388"
        },
        "source": "https://github.com/yugabyte/yugabyte-db/commit/9687371d8777f876285b737a9d01995bc46bafa5",
        "id": "CVE-2024-6895-efc9018f",
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "managed/src/test/java/com/yugabyte/yw/controllers/UsersControllerTest.java",
            "function": "testPasswordChangeValid"
        }
    }
]