CVE-2024-33396

EUVD-2024-1826
An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. NOTE: Then maintainer states that the behavior is intended design and notes that the researcher advisory does not provide evidence of arbitrary code execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.4 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 7.59%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
karmada-iokarmada
𝑥
≤ 1.9.0
ADP
Common Weakness Enumeration
References
https://gist.github.com/HouqiyuA/2b56a893c06553013982836abb77ba50
https://github.com/github/advisory-database/pull/10318
https://gist.github.com/HouqiyuA/2b56a893c06553013982836abb77ba50