CVE-2024-6895
- Source
- https://cve.org/CVERecord?id=CVE-2024-6895
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-6895.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-6895
- Published
- 2024-07-19T14:47:50.432Z
- Modified
- 2026-05-14T04:03:48.610069381Z
- Severity
-
- 6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H CVSS Calculator
- Summary
- Insecure Account Profile Management
- Details
-
Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. An attacker with user session and access to application can modify settings such as password and email without being prompted for the current password, enabling account takeover.
- Database specific
{ "cna_assigner": "Yugabyte", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6895.json", "cwe_ids": [ "CWE-306" ] }- References