CVE-2024-45054

MEDIUM EPSS 16.4%
Published Aug 28, 20241y ago · Modified Jun 17, 20262w ago
6.7 CVSS 3.1
Medium
Find Similar
Published Aug 28, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Hwameistor is an HA local storage system for cloud-native stateful workloads. This ClusterRole has * verbs of * resources. If a malicious user can access the worker node which has hwameistor's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation. This issue has been patched in version 0.14.6. All users are advised to upgrade. Users unable to upgrade should update and limit the ClusterRole using security-role.

CVSS Details

Base Score
6.7
Exploitability
0.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
16.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure

Affected Products 1

VendorProductVersionRange
hwameistorhwameistor* <0.14.6

References 5

  • github.com https://github.com/hwameistor/hwameistor/blob/main/helm/hwameistor/templates/clusterrole.yaml
    Product
  • github.com https://github.com/hwameistor/hwameistor/commit/edf4cebed73cadd230bf97eab65c5311f2858450
    Patch
  • github.com https://github.com/hwameistor/hwameistor/issues/1457
    Issue Tracking
  • github.com https://github.com/hwameistor/hwameistor/issues/1460
    Issue Tracking
  • github.com https://github.com/hwameistor/hwameistor/security/advisories/GHSA-mgwr-h7mv-fh29
    Vendor Advisory

Remediation

  • github.com https://github.com/hwameistor/hwameistor/commit/edf4cebed73cadd230bf97eab65c5311f2858450
    Patch