CVE-2024-22412

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22412", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-01-10T15:09:55.551Z", "datePublished": "2024-03-18T20:51:40.313Z", "dateUpdated": "2024-08-01T22:43:34.945Z"}, "containers": {"cna": {"title": "ClickHouse's Role-based Access Control is bypassed when query caching is enabled.", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-45h5-f7g3-gr8r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-45h5-f7g3-gr8r"}, {"name": "https://github.com/ClickHouse/ClickHouse/pull/58611", "tags": ["x_refsource_MISC"], "url": "https://github.com/ClickHouse/ClickHouse/pull/58611"}, {"name": "https://github.com/ClickHouse/ClickHouse/blob/bd17ee769e337906c4b1f404861e042ad72fcbfc/src/Interpreters/executeQuery.cpp#L1013-L1015", "tags": ["x_refsource_MISC"], "url": "https://github.com/ClickHouse/ClickHouse/blob/bd17ee769e337906c4b1f404861e042ad72fcbfc/src/Interpreters/executeQuery.cpp#L1013-L1015"}], "affected": [{"vendor": "ClickHouse", "product": "ClickHouse", "versions": [{"version": "= 23.1", "status": "affected"}, {"version": "< 24.0.2.54535", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-18T20:51:40.313Z"}, "descriptions": [{"lang": "en", "value": "ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles. In affected versions, the query cache only respects separate users, however this is not documented and not expected behavior. People relying on ClickHouse roles can have their access control lists bypassed if they are using query caching. Attackers who have control of a role could guess queries and see data they shouldn't have access to. Version 24.1 of ClickHouse and version 24.0.2.54535 of ClickHouse Cloud contain a patch for this issue. Based on the documentation, role based access control should be enforced regardless if query caching is enabled or not."}], "source": {"advisory": "GHSA-45h5-f7g3-gr8r", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "clickhouse", "product": "clickhouse", "cpes": ["cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "24.0.2.54535", "versionType": "custom"}]}, {"vendor": "clickhouse", "product": "clickhouse", "cpes": ["cpe:2.3:a:clickhouse:clickhouse:23.1:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "23.1", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-16T00:15:45.594283Z", "id": "CVE-2024-22412", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-16T00:17:44.421Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:34.945Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-45h5-f7g3-gr8r", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-45h5-f7g3-gr8r"}, {"name": "https://github.com/ClickHouse/ClickHouse/pull/58611", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ClickHouse/ClickHouse/pull/58611"}, {"name": "https://github.com/ClickHouse/ClickHouse/blob/bd17ee769e337906c4b1f404861e042ad72fcbfc/src/Interpreters/executeQuery.cpp#L1013-L1015", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/ClickHouse/ClickHouse/blob/bd17ee769e337906c4b1f404861e042ad72fcbfc/src/Interpreters/executeQuery.cpp#L1013-L1015"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-45h5-f7g3-gr8r", "name": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-45h5-f7g3-gr8r", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/ClickHouse/ClickHouse/pull/58611", "name": "https://github.com/ClickHouse/ClickHouse/pull/58611", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/ClickHouse/ClickHouse/blob/bd17ee769e337906c4b1f404861e042ad72fcbfc/src/Interpreters/executeQuery.cpp#L1013-L1015", "name": "https://github.com/ClickHouse/ClickHouse/blob/bd17ee769e337906c4b1f404861e042ad72fcbfc/src/Interpreters/executeQuery.cpp#L1013-L1015", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:43:34.945Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22412", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-16T00:15:45.594283Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*"], "vendor": "clickhouse", "product": "clickhouse", "versions": [{"status": "affected", "version": "0", "lessThan": "24.0.2.54535", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:clickhouse:clickhouse:23.1:*:*:*:*:*:*:*"], "vendor": "clickhouse", "product": "clickhouse", "versions": [{"status": "affected", "version": "23.1"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-16T00:14:59.456Z"}}], "cna": {"title": "ClickHouse's Role-based Access Control is bypassed when query caching is enabled.", "source": {"advisory": "GHSA-45h5-f7g3-gr8r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "ClickHouse", "product": "ClickHouse", "versions": [{"status": "affected", "version": "= 23.1"}, {"status": "affected", "version": "< 24.0.2.54535"}]}], "references": [{"url": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-45h5-f7g3-gr8r", "name": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-45h5-f7g3-gr8r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ClickHouse/ClickHouse/pull/58611", "name": "https://github.com/ClickHouse/ClickHouse/pull/58611", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ClickHouse/ClickHouse/blob/bd17ee769e337906c4b1f404861e042ad72fcbfc/src/Interpreters/executeQuery.cpp#L1013-L1015", "name": "https://github.com/ClickHouse/ClickHouse/blob/bd17ee769e337906c4b1f404861e042ad72fcbfc/src/Interpreters/executeQuery.cpp#L1013-L1015", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles. In affected versions, the query cache only respects separate users, however this is not documented and not expected behavior. People relying on ClickHouse roles can have their access control lists bypassed if they are using query caching. Attackers who have control of a role could guess queries and see data they shouldn't have access to. Version 24.1 of ClickHouse and version 24.0.2.54535 of ClickHouse Cloud contain a patch for this issue. Based on the documentation, role based access control should be enforced regardless if query caching is enabled or not."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-18T20:51:40.313Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22412", "state": "PUBLISHED", "dateUpdated": "2024-08-01T22:43:34.945Z", "dateReserved": "2024-01-10T15:09:55.551Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-03-18T20:51:40.313Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "ClickHouse", "vendor": "ClickHouse", "versions": [{"status": "affected", "version": "= 23.1"}, {"status": "affected", "version": "< 24.0.2.54535"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "clickhouse", "vendor": "clickhouse", "versions": [{"lessThan": "24.0.2.54535", "status": "affected", "version": "0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:clickhouse:clickhouse:23.1:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "clickhouse", "vendor": "clickhouse", "versions": [{"status": "affected", "version": "23.1"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*", "matchCriteriaId": "D5A8F53C-5FD5-4DE8-B7C1-1C1B2E4D7A6D", "versionEndExcluding": "23.3.22.3", "versionStartIncluding": "23.3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*", "matchCriteriaId": "114A3542-F590-40E8-A0B5-1ABC2FE8EC39", "versionEndExcluding": "23.8.12.13", "versionStartIncluding": "23.8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*", "matchCriteriaId": "34B61373-588A-404A-B78D-BE0868B06D1C", "versionEndExcluding": "23.12.6.19", "versionStartIncluding": "23.12.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*", "matchCriteriaId": "F079F245-8B1B-4CE5-9F4D-AB49A815A0CE", "versionEndExcluding": "24.1.1.2048", "versionStartIncluding": "24.0.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:clickhouse:clickhouse_cloud:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C7A6C10-D54D-4456-B4C7-C04CA1162C67", "versionEndExcluding": "24.0.2.54535", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles. In affected versions, the query cache only respects separate users, however this is not documented and not expected behavior. People relying on ClickHouse roles can have their access control lists bypassed if they are using query caching. Attackers who have control of a role could guess queries and see data they shouldn't have access to. Version 24.1 of ClickHouse and version 24.0.2.54535 of ClickHouse Cloud contain a patch for this issue. Based on the documentation, role based access control should be enforced regardless if query caching is enabled or not."}, {"lang": "es", "value": "ClickHouse es un sistema de gesti\u00f3n de bases de datos orientado a columnas de c\u00f3digo abierto. Existe un error en la oferta de nube de ClickHouse anterior a la versi\u00f3n 24.0.2.54535 y en github.com/clickhouse/clickhouse versi\u00f3n 23.1. El almacenamiento en cach\u00e9 de consultas evita los controles de acceso basados en roles y las pol\u00edticas que se aplican a los roles. En las versiones afectadas, la cach\u00e9 de consultas solo respeta a usuarios separados; sin embargo, esto no est\u00e1 documentado ni es un comportamiento esperado. Las personas que dependen de roles de ClickHouse pueden evitar sus listas de control de acceso si utilizan el almacenamiento en cach\u00e9 de consultas. Los atacantes que tienen control de una funci\u00f3n podr\u00edan adivinar consultas y ver datos a los que no deber\u00edan tener acceso. La versi\u00f3n 24.1 de ClickHouse y la versi\u00f3n 24.0.2.54535 de ClickHouse Cloud contienen un parche para este problema. Seg\u00fan la documentaci\u00f3n, se debe aplicar el control de acceso basado en roles independientemente de si el almacenamiento en cach\u00e9 de consultas est\u00e1 habilitado o no."}], "id": "CVE-2024-22412", "lastModified": "2026-06-17T07:11:21.670", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-22412", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-07-16T00:15:45.594283Z", "version": "2.0.3"}}]}, "published": "2024-03-18T21:15:06.230", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/ClickHouse/ClickHouse/blob/bd17ee769e337906c4b1f404861e042ad72fcbfc/src/Interpreters/executeQuery.cpp#L1013-L1015"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/ClickHouse/ClickHouse/pull/58611"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-45h5-f7g3-gr8r"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://github.com/ClickHouse/ClickHouse/blob/bd17ee769e337906c4b1f404861e042ad72fcbfc/src/Interpreters/executeQuery.cpp#L1013-L1015"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/ClickHouse/ClickHouse/pull/58611"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-45h5-f7g3-gr8r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-07-12T16:01:21.022720+00:00", "updated": "2025-07-12T16:01:21.022802+00:00", "vendors": ["clickhouse", "clickhouse$PRODUCT$clickhouse"]}