CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2024-46528
Medium (4.3). EPSS 1.6% chance of exploitation in the next 30 days. Fixed in github.com/kubesphere/kubesphere 3.4.1, 4.1.3.
An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x before 4.1.3 and 3.x through 3.5.0 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks.
Severity
- EPSS
- 1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
- CWE
- CWE-639
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p26r-gfgc-c47h | Go | github.com/kubesphere/kubesphere | >=4.0.0 <4.1.3 | 4.1.3 |
| GHSA-p26r-gfgc-c47h | Go | github.com/kubesphere/kubesphere | >=3.0.0 <3.4.1 | 3.4.1 |
| GO-2024-3248 | Go | github.com/kubesphere/kubesphere | all versions | no fix published |