CVE-2024-41820

Katalog CVE

CVSS 6.0 · Medium EPSS 0,41%

Kerentanan Incorrect Permission Assignment for Critical Resource. Skor CVSS 3.1 6.0 (Medium) menurut github.com.

Deskripsi (NVD)

Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has `*` verbs of `*` resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation. This issue has been addressed in release version 0.18.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

5 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

6.0 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/kubean-io/kubean/commit/167e97329e4a27ba2f456d2846d39af20e1af7ef
• https://github.com/kubean-io/kubean/issues/1326
• https://github.com/kubean-io/kubean/security/advisories/GHSA-3wfj-3x8q-hrpg