GitHub Advisoryadvisory · Go

GHSA-4jhw-c53w-w5r7 PipeCD Vulnerable to Privilege Escalation

HIGH Published 2025-03-21 Modified 2025-03-24 Official page ↗
Aliases
CVE-2024-53351
Ecosystem
Go
Packages
github.com/pipe-cd/pipecd
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-276, CWE-284, CWE-732
Reviewed
2025-03-21

Affected packages

• Go github.com/pipe-cd/pipecd: <= 0.49.0 (no fix yet)

Description

Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.

Related

Alias · CVE (1)

  • CVE-2024-53351 Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges. vulnerability

Weakness · CWE (3)

  • CWE-276 Incorrect Default Permissions weakness
  • CWE-284 Improper Access Control weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References