CVE-2024-45054

Published: Aug 28, 2024Modified: Jun 17, 2026

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

Hwameistor is an HA local storage system for cloud-native stateful workloads. This ClusterRole has * verbs of * resources. If a malicious user can access the worker node which has hwameistor's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation. This issue has been patched in version 0.14.6. All users are advised to upgrade. Users unable to upgrade should update and limit the ClusterRole using security-role.

Affected (1)

Products: Hwameistor: Hwameistor

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hwameistor Hwameistor	Before 0.14.6

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (5)

https://github.com/hwameistor/hwameistor/blob/main/helm/hwameistor/templates/clusterrole.yaml

Source: security-advisories@github.com

Product

https://github.com/hwameistor/hwameistor/commit/edf4cebed73cadd230bf97eab65c5311f2858450

Source: security-advisories@github.com

Patch

https://github.com/hwameistor/hwameistor/issues/1457

Source: security-advisories@github.com

Issue Tracking

https://github.com/hwameistor/hwameistor/issues/1460

Source: security-advisories@github.com

Issue Tracking

https://github.com/hwameistor/hwameistor/security/advisories/GHSA-mgwr-h7mv-fh29

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.