CVE-2024-22409 Default Privileges allow for high level operations for low privileged users in datahub
Low-privileged users can perform admin actions like removing users or editing profiles due to overly broad default permissions, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-22409?
CVE-2024-22409 is a high-severity missing authorization vulnerability in datahub-project datahub, published on 16 Jan 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile information. The default privileges gave too many broad permissions to low privileged users. These have been constrained in PR #9067 to prevent abuse. This issue can result in privilege escalation for lower privileged users up to admin privileges, potentially, if a group with admin privileges exists. May not impact instances that have modified default privileges. This issue has been addressed in datahub version 0.12.1. Users are advised to upgrade.
Weakness: CWE-276
Which versions are affected by CVE-2024-22409?
It affects 1 product.
Products include Datahub Project Datahub.
How do I fix CVE-2024-22409?
No fix has been published for CVE-2024-22409 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-22409 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-22409 exists.
Other vulnerabilities in datahub-project datahub
Sources
Also known as GHSA-x3v6-r479-m4xv.