Today > | 1 Medium vulnerabilities   -   You can now download lists of IOCs here!

CVE-2024-9779

Dec. 17, 2024, 11:15 p.m.

CVSS Score

7.5 / 10

Product(s) Impacted

Open Cluster Management (OCM)

Description

A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name "cluster-manager" which is bound to a ClusterRole also named "cluster-manager", which includes the permission to create Pod resources. If this deployment runs a pod on an attacker-controlled node, the attacker can obtain the cluster-manager's token and steal any service account token by creating and mounting the target service account to control the whole cluster.

Weaknesses

CWE-501
Trust Boundary Violation

The product mixes trusted and untrusted data in the same data structure or structured message.

CWE ID: 501

Date

Published: Dec. 17, 2024, 11:15 p.m.

Last Modified: Dec. 17, 2024, 11:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

secalert@redhat.com

CVSS Data

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

Base Score
7.5
Exploitability Score
2.2
Impact Score
4.7
Base Severity
HIGH
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

References

https://access.redhat.com/ secalert@redhat.com

https://bugzilla.redhat.com/ secalert@redhat.com

https://github.com/ secalert@redhat.com

https://github.com/ secalert@redhat.com

https://github.com/ secalert@redhat.com