Skip to content

karmada vulnerable to arbitrary code execution via a crafted command

Moderate severity GitHub Reviewed Published May 2, 2024 to the GitHub Advisory Database • Updated May 3, 2024

Package

gomod github.com/karmada-io/karmada (Go)

Affected versions

<= 1.9.0

Patched versions

None

Description

An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.

References

Published by the National Vulnerability Database May 2, 2024
Published to the GitHub Advisory Database May 2, 2024
Reviewed May 3, 2024
Last updated May 3, 2024

Severity

Moderate

Weaknesses

No CWEs

CVE ID

CVE-2024-33396

GHSA ID

GHSA-wccg-v638-j9q2

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.