CVE-2024-22409: high-severity vulnerability in datahub-project datahub
Default Privileges allow for high level operations for low privileged users in datahub
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.7%
DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile information. The default privileges gave too many broad permissions to low privileged users. These have been constrained in PR #9067 to prevent abuse. This issue can result in privilege escalation for lower privileged users up to admin privileges, potentially, if a group with admin privileges exists. May not impact instances that have modified default privileges. This issue has been addressed in datahub version 0.12.1. Users are advised to upgrade.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
datahub-project · datahubRelated CVEs — datahub-project datahub
In the same product, most dangerous first.
CVE-2022-39366CRITICALDataHub missing JWT signature checkEPSS 1.1%CVE-2023-25558HIGHDeserialization of untrusted data in DataHubEPSS 1.0%CVE-2023-25557HIGHServer-Side Request Forgery in DataHubEPSS 0.7%CVE-2023-25560HIGHJSON Injection in DataHubEPSS 0.6%CVE-2023-25559HIGHSystem account impersonation in DataHubEPSS 0.5%CVE-2023-47629HIGHPrivilege escalation through email sign-up in datahubEPSS 0.5%