Products
Submariner
Source
secalert@redhat.com
Tags
CVE-2024-5042 details
Published : May 17, 2024, 2:15 p.m.
Last Modified : May 17, 2024, 6:35 p.m.
Last Modified : May 17, 2024, 6:35 p.m.
Description
A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6.6 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|
CVSS Data
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
NONE
Base Score
6.6
Exploitability Score
Impact Score
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N
References
| URL | Source |
|---|---|
| https://access.redhat.com/security/cve/CVE-2024-5042 | secalert@redhat.com |
| https://bugzilla.redhat.com/show_bug.cgi?id=2280921 | secalert@redhat.com |
This website uses the NVD API, but is not approved or certified by it.