GitHub Advisoryadvisory · Go

GHSA-6fg2-hvj9-832f piraeus-operator allows attacker to impersonate service account

HIGH Published 2024-05-03 Modified 2024-07-03 Official page ↗
Aliases
CVE-2024-33398
Ecosystem
Go
Packages
github.com/piraeusdatastore/piraeus-operator/v2
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-269
Reviewed
2024-05-03

Affected packages

• Go github.com/piraeusdatastore/piraeus-operator/v2: <= 2.5.0 (no fix yet)

Description

There is a ClusterRole in piraeus-operator v2.5.0 and earlier which has been granted list secrets permission, which allows an attacker to impersonate the service account bound to this ClusterRole and use its high-risk privileges to list confidential information across the cluster.

Related

Alias · CVE (1)

  • CVE-2024-33398 There is a ClusterRole in piraeus-operator v2.5.0 and earlier which has been granted list secrets permission, which allows an attacker to… vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References