{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22047", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2024-01-04T18:44:53.107Z", "datePublished": "2024-01-04T20:32:02.771Z", "dateUpdated": "2024-08-01T22:35:34.846Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://rubygems.org", "defaultStatus": "unaffected", "packageName": "audited", "versions": [{"lessThan": "5.3.3", "status": "affected", "version": "4.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.</p>"}], "value": "A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2024-01-04T20:32:02.771Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww"}, {"tags": ["issue-tracking"], "url": "https://github.com/collectiveidea/audited/issues/601"}, {"tags": ["related"], "url": "https://github.com/collectiveidea/audited/pull/669"}, {"tags": ["related"], "url": "https://github.com/collectiveidea/audited/pull/671"}, {"tags": ["third-party-advisory"], "url": "https://github.com/advisories/GHSA-hjp3-5g2q-7jww"}, {"tags": ["third-party-advisory"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-hjp3-5g2q-7jww"}], "source": {"discovery": "INTERNAL"}, "title": "Audited Log Integrity Errors Due to Race Condition"}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.846Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww"}, {"tags": ["issue-tracking", "x_transferred"], "url": "https://github.com/collectiveidea/audited/issues/601"}, {"tags": ["related", "x_transferred"], "url": "https://github.com/collectiveidea/audited/pull/669"}, {"tags": ["related", "x_transferred"], "url": "https://github.com/collectiveidea/audited/pull/671"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://github.com/advisories/GHSA-hjp3-5g2q-7jww"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-hjp3-5g2q-7jww"}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:collectiveidea:audited:*:*:*:*:*:*:*:*", "matchCriteriaId": "6F9F98EC-034A-4BD6-85FF-038B75CC82BF", "versionEndExcluding": "5.3.3", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.\n\n"}, {"lang": "es", "value": "Existe una condici\u00f3n de ejecuci\u00f3n en Audited 4.0.0 a 5.3.3 que puede provocar que un usuario autenticado haga que las entradas del registro de auditor\u00eda se atribuyan a otro usuario."}], "id": "CVE-2024-22047", "lastModified": "2024-11-21T08:55:27.380", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "[email protected]", "type": "Primary"}]}, "published": "2024-01-04T21:15:09.720", "references": [{"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/advisories/GHSA-hjp3-5g2q-7jww"}, {"source": "[email protected]", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://github.com/collectiveidea/audited/issues/601"}, {"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/collectiveidea/audited/pull/669"}, {"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/collectiveidea/audited/pull/671"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-hjp3-5g2q-7jww"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/advisories/GHSA-hjp3-5g2q-7jww"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://github.com/collectiveidea/audited/issues/601"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/collectiveidea/audited/pull/669"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/collectiveidea/audited/pull/671"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-hjp3-5g2q-7jww"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "[email protected]", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:2010", "cpe": "cpe:/a:redhat:satellite:6.15::el8", "package": "rubygem-audited-0:5.4.2-1.el8sat", "product_name": "Red Hat Satellite 6.15 for RHEL 8", "release_date": "2024-04-23T00:00:00Z"}], "bugzilla": {"description": "audited: race condition can lead to audit logs being incorrectly attributed to the wrong user", "id": "2256891", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2256891"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "verified"}, "cwe": "CWE-362", "details": ["A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.", "A race condition flaw was found in Audited. This issue may allow an authenticated user to attribute audit log entries to another user."], "name": "CVE-2024-22047", "public_date": "2024-01-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-22047\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-22047"], "threat_severity": "Low", "upstream_fix": "audited 5.3.3"}