Base Score

HIGH8.4

CVE-2024-33396

An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.

VectorLOCAL

Published Bycve@mitre.org

Published DateMay 02, 2024, 19:15

Affected Versions(1)

github.com/karmada-io/karmada(Go)

Introduced0

FixedN/A

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
github.com/karmada-io/karmada(Go)	0	N/A	N/A

Weakness Type (CWE):CWE-284

CVSS Metrics

Base Score

8.4

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

LOCAL

Attack Complexity (AC)

LOW

Privileges Required (PR)

LOW

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

NONE

References

https://gist.github.com/HouqiyuA/2b56a893c06553013982836abb77ba50

Base Score

HIGH8.4

Weakness Type (CWE):CWE-284

CVSS Metrics

Base Score

8.4

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

LOCAL

Attack Complexity (AC)

LOW

Privileges Required (PR)

LOW

User Interaction (UI)

NONE

Scope (S)

CHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

NONE