CVE-2024-25131

Published: Dec 19, 2024Modified: Jun 17, 2026Deferred

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource (CRD) of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard developer user to escalate their privileges to a cluster administrator and pivot to the AWS environment.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

https://access.redhat.com/security/cve/CVE-2024-25131

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2258856

Source: secalert@redhat.com

https://github.com/openshift/must-gather-operator/pull/135

Source: secalert@redhat.com

https://github.com/openshift/must-gather-operator/pull/138

Source: secalert@redhat.com

Timeline

No history available yet.