CVE-2024-9858: Insecure user permissions in Google Cloud Migrate to Containers for Windows
There exists an insecure default user permission in Google Cloud Migrate to containers from version 1.1.0 to 1.2.2 Windows installs. A local "m2cuser" was greated with administrator privileges. This posed a security risk if the "analyze" or "generate" commands were interrupted or skipping the action to delete the local user “m2cuser”. We recommend upgrading to 1.2.3 or beyond
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9858?
CVE-2024-9858 has been classified as a high severity vulnerability due to its potential to allow unauthorized access to sensitive features.
How do I fix CVE-2024-9858?
To fix CVE-2024-9858, update Google Cloud Migrate to Containers to the latest version beyond 1.2.2, ensuring the insecure default user permissions are corrected.
What are the implications of CVE-2024-9858?
The implications of CVE-2024-9858 include potential unauthorized administrative access if the default user is exploited during certain command interruptions.
Which versions of Google Cloud Migrate to Containers are affected by CVE-2024-9858?
CVE-2024-9858 affects Google Cloud Migrate to Containers versions 1.1.0 to 1.2.2.
What actions should I take if I am using an affected version of Google Cloud Migrate to Containers due to CVE-2024-9858?
If using an affected version, immediately update to a secure version and review user permissions to mitigate risks associated with CVE-2024-9858.