CVE-2024-22047

Audited Log Integrity Errors Due to Race Condition

3.1 LowFix available

A race condition exists in Audited 4.0.0 before 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.50%Up 0.4 points since Jan 18, 2024

What each source reports

CVE List Score used 3.1

Audited Log Integrity Errors Due to Race Condition

A race condition exists in Audited 4.0.0 before 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.

Record: CVE-2024-22047
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-362
Updated: 2026-11-02

EUVDEUVD-2023-1560 3.1

A race condition exists in Audited 4.0.0 before 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.

Record: EUVD-2023-1560
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-hjp3-5g2q-7jww 3.1

Race Condition leading to logging errors

In certain setups with threaded web servers, Audited's use of Thread.current can incorrectly attributed audits to the wrong user.

Fixed in 5.3.3.

In March, @convisoappsec noticed that the library in question had a Race Condition problem, which caused logs to be registered at times with different users than those who performed the genuine actions.

The first issue we identified was from November 2021: https://github.com/collectiveidea/audited/issues/601
So the solution was implemented in the following Pull Request: https://github.com/collectiveidea/audited/pull/669
And the feature was published in version 5.3.3: RELEASE: https://github.com/collectiveidea/audited/pull/671

Record: GHSA-hjp3-5g2q-7jww
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

NVD 3.1

A race condition exists in Audited 4.0.0 before 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.

Record: CVE-2024-22047
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-362
Updated: 2026-11-02

OSV 3.1

Audited Log Integrity Errors Due to Race Condition

A race condition exists in Audited 4.0.0 before 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.

Record: CVE-2024-22047
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-362
Updated: 2026-11-02

OSVGHSA-hjp3-5g2q-7jww 3.1

Race Condition leading to logging errors

In certain setups with threaded web servers, Audited's use of Thread.current can incorrectly attributed audits to the wrong user.

Fixed in 5.3.3.

The first issue we identified was from November 2021: https://github.com/collectiveidea/audited/issues/601
So the solution was implemented in the following Pull Request: https://github.com/collectiveidea/audited/pull/669
And the feature was published in version 5.3.3: RELEASE: https://github.com/collectiveidea/audited/pull/671

Record: GHSA-hjp3-5g2q-7jww
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVRHSA-2024:2010 7.6

Red Hat Security Advisory: Satellite 6.15.0 release

Record: RHSA-2024:2010
CVSS 3.1: 7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Updated: 2026-11-02

Affected products

collectiveidea audited

Affected packages

Affected packages
Package	Affected	Fixed
`audited` RubyGems	4.0.0 up to 5.3.3	5.3.3
`audited` RubyGems	4.0.0 up to 5.3.3, plus listed versions 4.10.04.2.04.2.14.2.24.3.0 Show 16 moreShow less 4.4.04.4.14.5.04.6.04.7.04.7.14.8.04.9.05.0.05.0.15.0.25.1.05.2.05.3.05.3.15.3.2	5.3.3
`python-pygments` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:2.17.0-1.el8pc	0:2.17.0-1.el8pc
`python3.11-pygments` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:2.17.0-1.el8pc	0:2.17.0-1.el8pc
`python-pygments` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:2.17.0-1.el8pc	0:2.17.0-1.el8pc
`python3.11-pygments` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:2.17.0-1.el8pc	0:2.17.0-1.el8pc
`foreman` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-debug` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman` Red Hat:satellite_utils:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-cli` Red Hat:satellite_utils:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat

Show 51 moreShow less

Affected packages
Package	Affected	Fixed
`foreman` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-cli` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-debug` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-dynflow-sidekiq` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-ec2` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-journald` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-libvirt` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-openstack` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-ovirt` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-pcp` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-postgresql` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-redis` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-service` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-telemetry` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`foreman-vmware` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.1.6-1.el8sat	0:3.9.1.6-1.el8sat
`python-galaxy-importer` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:0.4.19-2.el8pc	0:0.4.19-2.el8pc
`python3.11-galaxy-importer` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:0.4.19-2.el8pc	0:0.4.19-2.el8pc
`python-galaxy-importer` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:0.4.19-2.el8pc	0:0.4.19-2.el8pc
`python3.11-galaxy-importer` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:0.4.19-2.el8pc	0:0.4.19-2.el8pc
`puppetserver` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:7.14.0-1.el8sat	0:7.14.0-1.el8sat
`puppetserver` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:7.14.0-1.el8sat	0:7.14.0-1.el8sat
`python-aiohttp` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python-aiohttp-debugsource` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python3.11-aiohttp` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python3.11-aiohttp-debuginfo` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python-aiohttp` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python-aiohttp-debugsource` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python3.11-aiohttp` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`python3.11-aiohttp-debuginfo` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.9.2-1.el8pc	0:3.9.2-1.el8pc
`rubygem-activesupport` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:6.1.7.6-1.el8sat	0:6.1.7.6-1.el8sat
`rubygem-activesupport` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:6.1.7.6-1.el8sat	0:6.1.7.6-1.el8sat
`python-django` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:4.2.9-1.el8pc	0:4.2.9-1.el8pc
`python3.11-django` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:4.2.9-1.el8pc	0:4.2.9-1.el8pc
`python-django` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:4.2.9-1.el8pc	0:4.2.9-1.el8pc
`python3.11-django` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:4.2.9-1.el8pc	0:4.2.9-1.el8pc
`python-pycryptodomex` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python-pycryptodomex-debugsource` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python3.11-pycryptodomex` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python3.11-pycryptodomex-debuginfo` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python-pycryptodomex` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python-pycryptodomex-debugsource` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python3.11-pycryptodomex` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`python3.11-pycryptodomex-debuginfo` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.20.0-1.el8pc	0:3.20.0-1.el8pc
`rubygem-puma` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:6.4.2-1.el8sat	0:6.4.2-1.el8sat
`rubygem-puma-debuginfo` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:6.4.2-1.el8sat	0:6.4.2-1.el8sat
`rubygem-puma-debugsource` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:6.4.2-1.el8sat	0:6.4.2-1.el8sat
`rubygem-audited` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:5.4.2-1.el8sat	0:5.4.2-1.el8sat
`python-jinja2` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.1.3-1.el8pc	0:3.1.3-1.el8pc
`python3.11-jinja2` Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs	before 0:3.1.3-1.el8pc	0:3.1.3-1.el8pc
`python-jinja2` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.1.3-1.el8pc	0:3.1.3-1.el8pc
`python3.11-jinja2` Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs	before 0:3.1.3-1.el8pc	0:3.1.3-1.el8pc

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-22047 is a low vulnerability (CVSS 3.1) in Collectiveidea Audited, published May 1, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 42nd percentile. Fixed in audited 5.3.3.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 138 references. The JSON record has them.