CVE-2024-3744

Katalog CVE

CVSS 6.5 · Medium EPSS 0,27%

Kerentanan Insertion of Sensitive Information into Log File. Skor CVSS 3.1 6.5 (Medium) menurut liggitt.net.

Deskripsi (NVD)

A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.

Rincian

Terbit di NVD

15 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

6.5 (Medium), sumber liggitt.net
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• http://www.openwall.com/lists/oss-security/2024/05/09/4
• https://github.com/kubernetes/kubernetes/issues/124759
• https://groups.google.com/g/kubernetes-security-announce/c/hcgZE2MQo1A/m/Y4C6q-CYAgAJ