CVE-2024-3744
Kubernetes azure-file-csi-driver in versions before 1.29.4 and 1.30.1 discloses service account tokens in logs
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.
Se descubrió un problema de seguridad en azure-file-csi-driver donde un actor con acceso a los registros del controlador podía observar los tokens de la cuenta de servicio. Estos tokens podrían luego intercambiarse con proveedores de nube externos para acceder a los secretos almacenados en soluciones de bóveda en la nube. Los tokens solo se registran cuando TokenRequests está configurado en el objeto CSIDriver y el controlador está configurado para ejecutarse en el nivel de registro 2 o superior mediante el indicador -v.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-04-12 CVE Reserved
- 2024-05-15 CVE Published
- 2024-06-11 EPSS Updated
- 2024-08-01 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-532: Insertion of Sensitive Information into Log File
CAPEC
- CAPEC-54: Query System for Information
References (3)
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Kubernetes Search vendor "Kubernetes" | Azure-file-csi-driver Search vendor "Kubernetes" for product "Azure-file-csi-driver" | <= v1.29.3 Search vendor "Kubernetes" for product "Azure-file-csi-driver" and version " <= v1.29.3" | en |
Affected
|