CVE-2024-21400 Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
Attackers can exploit a path traversal flaw in Azure Kubernetes Service Confidential Containers to escalate privileges within the cloud environment.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-21400?
CVE-2024-21400 is a critical path traversal vulnerability in Microsoft Azure Kubernetes Service, published on 12 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
Weakness: CWE-22
Which versions are affected by CVE-2024-21400?
It affects 1 product.
Products include Microsoft Confcom.
How do I fix CVE-2024-21400?
No fix has been published for CVE-2024-21400 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-21400 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21400 exists.
Other vulnerabilities in Microsoft Azure Kubernetes Service
Sources
Also known as GHSA-c49c-7xhw-623r.