Vulnerability · Published Jul 24, 2024 · Assigned by redhat

CVE-2024-7079Openshift-console: unauthenticated installation of helm charts

Medium 6.5

In plain English

A medium-severity missing authentication in openshift-console. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 69.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart from a URI that is remote HTTP/HTTPS or local. Access to this endpoint is gated by the authHandlerWithUser() middleware function. Contrary to its name, this middleware function does not verify the validity of the user's credentials. As a result, unauthenticated users can access this endpoint.

Affected products (as reported)

Vendor	Product	Versions
	openshift-console	4.16
Red Hat	Red Hat OpenShift Container Platform 3.11	see references
Red Hat	Red Hat OpenShift Container Platform 4	see references

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://access.redhat.com/security/cve/CVE-2024-7079 vdb-entry, x_refsource_REDHAT
RHBZ#2299678 issue-tracking, x_refsource_REDHAT