CVE-2024-36539 Missing authorization in n/a
Attackers can access sensitive data and escalate privileges by obtaining the service account token due to insecure permissions in Contour.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-36539?
CVE-2024-36539 is a critical missing authorization vulnerability in n/a, published on 24 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Weakness: CWE-277
Which versions are affected by CVE-2024-36539?
1 open source package ship an affected version, including contour. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
contour Bitnami | From 1.28.3 | 1.28.4 |
Products include Projectcontour Contour.
How do I fix CVE-2024-36539?
Upgrade contour to 1.28.4 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-36539 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-36539 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as BIT-contour-2024-36539, GHSA-6xhf-2fjj-wq6j.