CVE-2024-5042

A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.6 MEDIUM
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N
redhatCNA
6.6 MEDIUM
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N
CISA-ADPADP
---
---
CVEADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 35%
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2024:4591
https://access.redhat.com/security/cve/CVE-2024-5042
https://bugzilla.redhat.com/show_bug.cgi?id=2280921
https://github.com/advisories/GHSA-2rhx-qhxp-5jpw
https://access.redhat.com/errata/RHSA-2024:4591
https://access.redhat.com/security/cve/CVE-2024-5042
https://bugzilla.redhat.com/show_bug.cgi?id=2280921
https://github.com/advisories/GHSA-2rhx-qhxp-5jpw