CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2024-25131
High (8.8). EPSS 0.8% chance of exploitation in the next 30 days. Fixed in github.com/openshift/must-gather 0.0.0-20240604173837-d1557bc283dd.
A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource (CRD) of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard developer user to escalate their privileges to a cluster administrator and pivot to the AWS environment.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-77c2-c35q-254w | Go | github.com/openshift/must-gather | <0.0.0-20240604173837-d1557bc283dd | 0.0.0-20240604173837-d1557bc283dd |
| GO-2024-3349 | Go | github.com/openshift/must-gather | all versions | no fix published |