CVE-2024-7631: Openshift-console: openshift console: path traversal
First published: Fri Jul 05 2024(Updated: )
A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112 Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ../ and valid directory paths.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat OpenShift Console | ||
| go/github.com/openshift/console | <=6.0.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-7631?
CVE-2024-7631 is rated as a high-severity vulnerability due to its potential impact on OpenShift Console users.
How do I fix CVE-2024-7631?
To mitigate CVE-2024-7631, ensure you are using a patched version of Red Hat OpenShift Console above 6.0.6.
Which versions of OpenShift Console are affected by CVE-2024-7631?
CVE-2024-7631 affects Red Hat OpenShift Console versions up to and including 6.0.6.
What components are impacted by CVE-2024-7631?
The vulnerability affects the OpenShift Console's handling of the /locales/resources.json endpoint.
Is CVE-2024-7631 exploitable remotely?
Yes, CVE-2024-7631 can be exploited remotely if the OpenShift Console is exposed to the internet.
- agent/title
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-7631
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-69x5-hjg4-m267
- agent/references
- agent/source
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/weakness
- collector/github-advisory
- vendor/red hat
- canonical/red hat openshift console
- package-manager/go