CVE-2024-6895: 
YugabyteDB vulnerability analysis and mitigation

Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session to change critical security information without re-authentication. The vulnerability (CVE-2024-6895) was discovered in July 2024 and affects the user account management functionality in Yugabyte Platform (NVD).

The vulnerability stems from a missing authentication check in the user account management system where users can modify critical security information such as passwords and email addresses without being prompted for their current password. This vulnerability has been assigned a CVSS v4.0 score of 6.1 (MEDIUM) with the vector string CVSS:4.0/AV:A/AC:H/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H. The issue is classified as CWE-306 (Missing Authentication for Critical Function) (NVD).

An attacker with a compromised user session and access to the application can modify critical account settings such as password and email without providing the current password, potentially leading to complete account takeover (NVD).

The vulnerability requires an attacker to have an active user session and access to the application. The attack complexity is considered high (AC:H) with privileged access required (PR:H), indicating that exploitation requires specific conditions to be met (NVD).

A fix has been implemented that deprecates the vulnerable API endpoint and introduces a new password reset API that requires current password verification. The new API PUT /customers/:cUUID/reset_password requires users to provide both their current password and new password for authentication (GitHub Commit).