CVE-2024-25131 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource (CRD) of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard developer user to escalate their privileges to a cluster administrator and pivot to the AWS environment.

Reserved 2024-02-05 | Published 2024-12-19 | Updated 2024-12-19 | Assigner redhat

HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

Improper Input Validation

Product status

Default status

unaffected

Any version before 4997ad93f0238464c626b1b4832d5b695d68517e

affected

Timeline

2024-01-17:	Reported to Red Hat.
2024-06-03:	Made public.

Credits

This issue was discovered by Thibault Guittet (Red Hat).

References

access.redhat.com/security/cve/CVE-2024-25131 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2258856 (RHBZ#2258856) issue-tracking

github.com/openshift/must-gather-operator/pull/135

github.com/openshift/must-gather-operator/pull/138

cve.org (CVE-2024-25131)

nvd.nist.gov (CVE-2024-25131)

Download JSON

https://cve.threatint.com/CVE/CVE-2024-25131

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.