CVE-2024-39924: High severity vaultwarden vulnerability
An issue was discovered in Vaultwarden (formerly BitwardenRS) 1.30.3. A vulnerability has been identified in the authentication and authorization process of the endpoint responsible for altering the metadata of an emergency access. It permits an attacker with granted emergency access to escalate their privileges by changing the access level and modifying the wait time. Consequently, the attacker can gain full control over the vault (when only intended to have read access) while bypassing the necessary wait period.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39924?
CVE-2024-39924 has a high severity level due to the potential for unauthorized access and escalation of privileges.
How do I fix CVE-2024-39924?
To fix CVE-2024-39924, upgrade to the latest version of Vaultwarden that addresses this vulnerability.
Which versions of Vaultwarden are affected by CVE-2024-39924?
CVE-2024-39924 affects Vaultwarden version 1.30.3 and possibly earlier versions.
What is the main issue associated with CVE-2024-39924?
CVE-2024-39924 involves a flaw in the authentication and authorization process that allows emergency access privileges to be escalated.
Is there a known exploit for CVE-2024-39924?
As of now, there is no public documentation on specific exploits for CVE-2024-39924, but the potential for exploitation exists.