CVE-2024-7631: falha de média gravidade em openshift-console
Openshift-console: openshift console: path traversal
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.5%
A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112 Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ../ and valid directory paths.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
openshift-consoleRed Hat · Red Hat OpenShift Container Platform 3.11Red Hat · Red Hat OpenShift Container Platform 4CVEs relacionadas — openshift-console
No mesmo produto, das mais perigosas para as menos.
CVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2024-12084CRITICALRsync: heap buffer overflow in rsync due to improper checksum length handlingEPSS 72.5%CVE-2025-10230CRITICALSamba: command injection in wins server hook scriptEPSS 39.8%CVE-2025-26466MEDIUMOpenssh: denial-of-service in opensshEPSS 38.7%CVE-2026-4480CRITICALSamba: samba: remote code execution in printing subsystem via unescaped job descriptionEPSS 28.7%CVE-2025-26465MEDIUMOpenssh: machine-in-the-middle attack if verifyhostkeydns is enabledEPSS 7.7%