Vulnerability · Published Oct 14, 2024 · Assigned by mitre
CVE-2024-46528
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in the github.com/kubesphere/kubesphere package (Go). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x before 4.1.3 and 3.x through 3.5.0 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/kubesphere/kubesphere | 4.1.3 | GHSA-p26r-gfgc-c47h |
| Go | github.com/kubesphere/kubesphere | 3.4.1 | GHSA-p26r-gfgc-c47h |
| Go | github.com/kubesphere/kubesphere | no fix listed | GO-2024-3248 |
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N