CVE-2024-3744mediumCWE-532

CVE-2024-3744: fallo de gravedad media en Kubernetes azure-file-csi-driver

Kubernetes azure-file-csi-driver in versions before 1.29.4 and 1.30.1 discloses service account tokens in logs

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear azure-file-csi-driver+ Monitorear sigs.k8s.io/azurefile-csi-driver

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.3%
A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Productos afectados
Kubernetes · azure-file-csi-driver