{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22047", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2024-01-04T18:44:53.107Z", "datePublished": "2024-01-04T20:32:02.771Z", "dateUpdated": "2024-08-01T22:35:34.846Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://rubygems.org", "defaultStatus": "unaffected", "packageName": "audited", "versions": [{"lessThan": "5.3.3", "status": "affected", "version": "4.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.</p>"}], "value": "A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2024-01-04T20:32:02.771Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww"}, {"tags": ["issue-tracking"], "url": "https://github.com/collectiveidea/audited/issues/601"}, {"tags": ["related"], "url": "https://github.com/collectiveidea/audited/pull/669"}, {"tags": ["related"], "url": "https://github.com/collectiveidea/audited/pull/671"}, {"tags": ["third-party-advisory"], "url": "https://github.com/advisories/GHSA-hjp3-5g2q-7jww"}, {"tags": ["third-party-advisory"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-hjp3-5g2q-7jww"}], "source": {"discovery": "INTERNAL"}, "title": "Audited Log Integrity Errors Due to Race Condition"}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.846Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww"}, {"tags": ["issue-tracking", "x_transferred"], "url": "https://github.com/collectiveidea/audited/issues/601"}, {"tags": ["related", "x_transferred"], "url": "https://github.com/collectiveidea/audited/pull/669"}, {"tags": ["related", "x_transferred"], "url": "https://github.com/collectiveidea/audited/pull/671"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://github.com/advisories/GHSA-hjp3-5g2q-7jww"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-hjp3-5g2q-7jww"}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:collectiveidea:audited:*:*:*:*:*:*:*:*", "matchCriteriaId": "6F9F98EC-034A-4BD6-85FF-038B75CC82BF", "versionEndExcluding": "5.3.3", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.\n\n"}, {"lang": "es", "value": "Existe una condici\u00f3n de ejecuci\u00f3n en Audited 4.0.0 a 5.3.3 que puede provocar que un usuario autenticado haga que las entradas del registro de auditor\u00eda se atribuyan a otro usuario."}], "id": "CVE-2024-22047", "lastModified": "2024-11-21T08:55:27.380", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-04T21:15:09.720", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://github.com/advisories/GHSA-hjp3-5g2q-7jww"}, {"source": "disclosure@vulncheck.com", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://github.com/collectiveidea/audited/issues/601"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/collectiveidea/audited/pull/669"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/collectiveidea/audited/pull/671"}, {"source": "disclosure@vulncheck.com", "tags": ["Vendor Advisory"], "url": "https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-hjp3-5g2q-7jww"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/advisories/GHSA-hjp3-5g2q-7jww"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://github.com/collectiveidea/audited/issues/601"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/collectiveidea/audited/pull/669"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/collectiveidea/audited/pull/671"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-hjp3-5g2q-7jww"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:2010", "cpe": "cpe:/a:redhat:satellite:6.15::el8", "package": "rubygem-audited-0:5.4.2-1.el8sat", "product_name": "Red Hat Satellite 6.15 for RHEL 8", "release_date": "2024-04-23T00:00:00Z"}], "bugzilla": {"description": "audited: race condition can lead to audit logs being incorrectly attributed to the wrong user", "id": "2256891", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2256891"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "verified"}, "cwe": "CWE-362", "details": ["A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.", "A race condition flaw was found in Audited. This issue may allow an authenticated user to attribute audit log entries to another user."], "name": "CVE-2024-22047", "public_date": "2024-01-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-22047\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-22047"], "threat_severity": "Low", "upstream_fix": "audited 5.3.3"}