What is GHSA-c9cm-5j82-m6pj?

GHSA-c9cm-5j82-m6pj is a security advisory published by GitHub Security Advisories with Critical severity. fabedge has insecure permissions

Which CVE IDs does GHSA-c9cm-5j82-m6pj cover?

GHSA-c9cm-5j82-m6pj covers the following CVE IDs: CVE-2024-36536. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c9cm-5j82-m6pj?

GHSA-c9cm-5j82-m6pj has a CVSS v3 base score of 7.4, published by GitHub Security Advisories.

Which products are affected by GHSA-c9cm-5j82-m6pj?

GHSA-c9cm-5j82-m6pj affects 1 product, including: go/github.com/fabedge/fabedge:\u003c= 0.8.1.

GHSA-c9cm-5j82-m6pjCriticalCVSS 7.4

fabedge has insecure permissions

Vendor

GitHub Security Advisories

Published

July 24, 2024

Last Modified

November 18, 2024

🔗 CVE IDs covered (1)

CVE-2024-36536 →

📋 Description

Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

🎯 Affected products1

go/github.com/fabedge/fabedge:<= 0.8.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-36536
https://gist.github.com/HouqiyuA/381f100f2ba82a8ada03994aac5bb2e8
https://pkg.go.dev/vuln/GO-2024-3027
https://github.com/advisories/GHSA-c9cm-5j82-m6pj