CVE-2024-33394 — Code Injection in Kubevirt

CWE-94 — Code Injection6 documents5 sources
Severity
5.9MEDIUMNVD
EPSS
0.0%
top 86.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Kubevirt.io KubevirtKubevirt
Timeline
PublishedMay 2
Latest updateJun 5

Description

An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 2.5 | Impact: 3.4

Affected Packages2 packages

🔴Vulnerability Details

4
OSV
kubevirt allows a local attacker to execute arbitrary code via a crafted command in kubevirt.io/kubevirt↗2024-06-05
▶
CVEList
CVE-2024-33394: An issue in kubevirt kubevirt v1↗2024-05-02
▶
GHSA
kubevirt allows a local attacker to execute arbitrary code via a crafted command↗2024-05-02
▶
OSV
kubevirt allows a local attacker to execute arbitrary code via a crafted command↗2024-05-02
▶

📋Vendor Advisories

1
Microsoft
An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.↗2024-05-14
▶
CVE-2024-33394 — Code Injection in Kubevirt.io Kubevirt | cvebase