What is GHSA-mgwr-h7mv-fh29?

GHSA-mgwr-h7mv-fh29 is a security advisory published by GitHub Security Advisories with Medium severity. Hwameistor Potential Permission Leakage of Cluster Level

Which CVE IDs does GHSA-mgwr-h7mv-fh29 cover?

GHSA-mgwr-h7mv-fh29 covers the following CVE IDs: CVE-2024-45054. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mgwr-h7mv-fh29?

GHSA-mgwr-h7mv-fh29 has a CVSS v3 base score of 2.3, published by GitHub Security Advisories.

Which products are affected by GHSA-mgwr-h7mv-fh29?

GHSA-mgwr-h7mv-fh29 affects 1 product, including: go/github.com/hwameistor/hwameistor:\u003c= 0.14.5.

GHSA-mgwr-h7mv-fh29MediumCVSS 2.3

Hwameistor Potential Permission Leakage of Cluster Level

Vendor

GitHub Security Advisories

Published

August 29, 2024

Last Modified

November 18, 2024

🔗 CVE IDs covered (1)

CVE-2024-45054 →

📋 Description

Impact

What kind of vulnerability is it? Who is impacted? This ClusterRole has * verbs of * resources. If a malicious user can access the worker node which has hwameistor's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation.

Patches

Has the problem been patched? What versions should users upgrade to?

= v0.14.6

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading? Update and Limit the ClusterRole using security-role.

References

Are there any links users can visit to find out more? issues: https://github.com/hwameistor/hwameistor/issues/1457 https://github.com/hwameistor/hwameistor/issues/1460

also reported by users via mails: sparkEchooo, younaman

🎯 Affected products1

go/github.com/hwameistor/hwameistor:<= 0.14.5