admin/cve
1
0
Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2025-05-05 10:17:57 +00:00
Code Issues Packages Projects Releases Wiki Activity
cve/2024/CVE-2024-42363.md
0xMarcio 992ed5df2f Update CVE sources 2024-08-22 18:33
2024-08-22 18:33:16 +00:00

946 B
Raw Permalink Blame History

CVE-2024-42363

Description

Prior to 3385, the user-controlled role parameter enters the application in the Kubernetes::RoleVerificationsController. The role parameter flows into the RoleConfigFile initializer and then into the Kubernetes::Util.parse_file method where it is unsafely deserialized using the YAML.load_stream method. This issue may lead to Remote Code Execution (RCE). This vulnerability is fixed in 3385.

POC

Reference

Github

No PoCs found on GitHub currently.