CVE-2024-58358

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-58358", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-06-08T15:20:35.497Z", "datePublished": "2026-07-18T13:10:02.254Z", "dateUpdated": "2026-07-28T01:47:47.875Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:47:47.875Z"}, "datePublic": "2024-11-22T00:00:00.000Z", "title": "SurrealDB before 2.1.0 Denial of Service via Nonexistent Role", "descriptions": [{"lang": "en", "value": "SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Uncaught Exception", "cweId": "CWE-248", "type": "CWE"}]}], "affected": [{"vendor": "surrealdb", "product": "surrealdb", "defaultStatus": "unaffected", "packageURL": "pkg:cargo/surrealdb", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "2.1.0"}, {"version": "2.1.0", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "surrealdb", "product": "surrealdb", "defaultStatus": "unaffected", "packageURL": "pkg:cargo/surrealdb-core", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "2.1.0"}, {"version": "2.1.0", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.1.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jc55-246c-r88f", "name": "GitHub Security Advisory (GHSA-jc55-246c-r88f)", "tags": ["vendor-advisory"]}, {"name": "VulnCheck Advisory: SurrealDB before 2.1.0 Denial of Service via Nonexistent Role", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-nonexistent-role"}], "credits": [{"lang": "en", "value": "garyhai", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T13:40:16.867765Z", "id": "CVE-2024-58358", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T13:40:23.989Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-58358", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T13:40:16.867765Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T13:40:20.598Z"}}], "cna": {"title": "SurrealDB before 2.1.0 Denial of Service via Nonexistent Role", "credits": [{"lang": "en", "type": "reporter", "value": "garyhai"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "surrealdb", "product": "surrealdb", "versions": [{"status": "affected", "version": "0", "lessThan": "2.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.0", "versionType": "semver"}], "packageURL": "pkg:cargo/surrealdb", "defaultStatus": "unaffected"}, {"vendor": "surrealdb", "product": "surrealdb", "versions": [{"status": "affected", "version": "0", "lessThan": "2.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.0", "versionType": "semver"}], "packageURL": "pkg:cargo/surrealdb-core", "defaultStatus": "unaffected"}], "datePublic": "2024-11-22T00:00:00.000Z", "references": [{"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jc55-246c-r88f", "name": "GitHub Security Advisory (GHSA-jc55-246c-r88f)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-nonexistent-role", "name": "VulnCheck Advisory: SurrealDB before 2.1.0 Denial of Service via Nonexistent Role", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-248", "description": "Uncaught Exception"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.1.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:47:47.875Z"}}}, "cveMetadata": {"cveId": "CVE-2024-58358", "state": "PUBLISHED", "dateUpdated": "2026-07-28T01:47:47.875Z", "dateReserved": "2026-06-08T15:20:35.497Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-07-18T13:10:02.254Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:cargo/surrealdb", "product": "surrealdb", "vendor": "surrealdb", "versions": [{"lessThan": "2.1.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:cargo/surrealdb-core", "product": "surrealdb", "vendor": "surrealdb", "versions": [{"lessThan": "2.1.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*", "matchCriteriaId": "B382EDCB-F0C0-4BFE-B543-66C4D16497DC", "versionEndExcluding": "2.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server."}, {"lang": "es", "value": "Versiones de SurrealDB anteriores a la 2.1.0 contienen una vulnerabilidad de denegaci\u00f3n de servicio en la conversi\u00f3n de roles que permite a usuarios propietarios privilegiados definir usuarios con roles inexistentes. Los atacantes pueden desencadenar un p\u00e1nico no capturado al iniciar sesi\u00f3n con un usuario al que se le asign\u00f3 un rol inv\u00e1lido, colapsando el servidor."}], "id": "CVE-2024-58358", "lastModified": "2026-10-27T18:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58358", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T13:40:16.867765Z", "version": "2.0.3"}}]}, "published": "2026-07-18T14:17:08.643", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Vendor Advisory"], "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jc55-246c-r88f"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-nonexistent-role"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-248"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.1.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "surrealdb", "source": "cna", "vendor": "surrealdb"}, "product": "surrealdb", "vendor": "surrealdb"}], "created": "2026-07-22T19:45:17.007448+00:00", "updated": "2026-07-30T23:15:06.063822+00:00", "vendors": ["surrealdb", "surrealdb$PRODUCT$surrealdb"]}