CVE-2024-30896

🗓️ 21 Nov 2024 00:00:00Reported by mitreType

InfluxDB 2.7.10 allows allAccess administrators to retrieve all raw tokens via an "influx auth ls" command. Supplier indicates it's intentional but a "poor design choice" to be changed in future release

Reporter	Title	Published	Views	Family All 21
GithubExploit	Exploit for CVE-2024-30896	22 Mar 202416:50	–	githubexploit
Circl	CVE-2024-30896	6 Sep 202415:55	–	circl
CNNVD	InfluxData InfluxDB 安全漏洞	21 Nov 202400:00	–	cnnvd
Cvelist	CVE-2024-30896	21 Nov 202400:00	–	cvelist
Debian CVE	CVE-2024-30896	21 Nov 202400:00	–	debiancve
Exploit DB	InfluxDB OSS 2.7.11 - Operator Token Privilege Escalation	8 Apr 202500:00	–	exploitdb
Microsoft CVE	InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and Clustered are not affected. NOTE: The researcher states that InfluxDB allows allAccess administrators to retrieve all raw tokens via an "influx auth ls" command. The supplier indicates that the organizations feature is operating as intended and that users may choose to add users to non-default organizations. A future release of InfluxDB 2.x will remove the ability to retrieve tokens from the API.	3 Sep 202521:33	–	mscve
NVD	CVE-2024-30896	21 Nov 202411:15	–	nvd
OSV	AZL-53438 CVE-2024-30896 affecting package influxdb 2.7.5-13	21 Nov 202411:15	–	osv
OSV	AZL-53622 CVE-2024-30896 affecting package influxdb 2.6.1-30	21 Nov 202411:15	–	osv

Vulnrichment

Node

influxdata influxdbRange0–2.7.10

Source	Link
github	www.github.com/XenoM0rph97/CVE-2024-30896
github	www.github.com/influxdata/influxdb/issues/24797
github	www.github.com/influxdata/influxdb/releases/tag/v2.8.0

15 Apr 2026 00:35Current

8.4High risk

Vulners AI Score8.4

CVSS 3.19.1

EPSS0.32457

SSVC

CWE-922