CVE-2024-3744

{"id": "CVE-2024-3744", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "jordan@liggitt.net", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.0}]}, "published": "2024-05-15T01:15:07.843", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/05/09/4", "source": "jordan@liggitt.net"}, {"url": "https://github.com/kubernetes/kubernetes/issues/124759", "source": "jordan@liggitt.net"}, {"url": "https://groups.google.com/g/kubernetes-security-announce/c/hcgZE2MQo1A/m/Y4C6q-CYAgAJ", "source": "jordan@liggitt.net"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "jordan@liggitt.net", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "A security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag.\n\n"}, {"lang": "es", "value": "Se descubri\u00f3 un problema de seguridad en azure-file-csi-driver donde un actor con acceso a los registros del controlador pod\u00eda observar los tokens de la cuenta de servicio. Estos tokens podr\u00edan luego intercambiarse con proveedores de nube externos para acceder a los secretos almacenados en soluciones de b\u00f3veda en la nube. Los tokens solo se registran cuando TokenRequests est\u00e1 configurado en el objeto CSIDriver y el controlador est\u00e1 configurado para ejecutarse en el nivel de registro 2 o superior mediante el indicador -v."}], "lastModified": "2024-06-10T16:15:16.980", "sourceIdentifier": "jordan@liggitt.net"}