Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2024-6840

Опубликовано: 05 сент. 2024
Источник: redhat
CVSS3: 6.6
EPSS Низкий

Описание

An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via automountServiceAccountToken: true, resulting in privilege escalation to a service account.

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-285
https://bugzilla.redhat.com/show_bug.cgi?id=2298492automation-controller: Gain access to the k8s API server via job execution with Container Group

EPSS

Процентиль: 24%
0.00082
Низкий

6.6 Medium

CVSS3

Связанные уязвимости

CVSS3: 6.6
nvd
больше 1 года назад

An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.

CVSS3: 6.6
github
больше 1 года назад

An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.

EPSS

Процентиль: 24%
0.00082
Низкий

6.6 Medium

CVSS3