CVE-2024-5042 Submariner-operator: rbac permissions can allow for the spread of node compromises
A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster.
Problem types: cwe_id: CWE-250
description: Execution with Unnecessary Privileges
Affected products: default_status: unaffected
vendor: Red Hat
product: RHODF-4.16-RHEL-9
cpes: cpe:/a:redhat:openshift_data_foundation:4.16::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Openshift Data Foundation 4.2
cpes: cpe:/a:redhat:openshift_data_foundation:4.20::el9
default_status: affected
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2
cpes: cpe:/a:redhat:acm:2
default_status: affected
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2
cpes: cpe:/a:redhat:acm:2
default_status: affected
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2
cpes: cpe:/a:redhat:acm:2
default_status: affected
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2
cpes: cpe:/a:redhat:acm:2
default_status: affected
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2
cpes: cpe:/a:redhat:acm:2
default_status: affected
vendor: Red Hat
product: Red Hat Advanced Cluster Management for Kubernetes 2
cpes: cpe:/a:redhat:acm:2
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N
version: 3.1
Published: 2024-05-17T13:12:00.551Z