Kubernetes Vulnerabilities and Affected Products
Vulnerabilities associated with azure-file-csi-driver.
Products
Clear product- Kubernetes51 vulnerabilities
- ingress-nginx17 vulnerabilities
- kubelet7 vulnerabilities
- Kubernetes ingress-nginx4 vulnerabilities
- Image Builder3 vulnerabilities
- minikube3 vulnerabilities
- image_builder2 vulnerabilities
- kube-apiserver2 vulnerabilities
- Kubernetes Java Client2 vulnerabilities
- Kubernetes Secrets Store CSI Driver2 vulnerabilities
- apiserver1 vulnerability
- argo-cd1 vulnerability
- aws-iam-authenticator1 vulnerability
- azure-file-csi-driver1 vulnerability
- CSI Driver for NFS1 vulnerability
- CSI Snapshotter1 vulnerability
- csi-proxy1 vulnerability
- devtron1 vulnerability
- k8s.gcr.io/defaultbackend1 vulnerability
- kops1 vulnerability
- Kubernetes CSharp Client1 vulnerability
- kubernetes-client/java1 vulnerability
- kubernetes-csi external-provisioner1 vulnerability
- kubernetes-csi external-resizer1 vulnerability
- kubernetes-csi external-snapshotter1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-3744MEDIUM | Kubernetes azure-file-csi-driver in versions before 1.29.4 and 1.30.1 discloses service account tokens in logsA security issue was discovered in azure-file-csi-driver where an actor with access to the driver logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are only logged when TokenRequests is configured in the CSIDriver object and the driver is set to run at log level 2 or greater via the -v flag. CWE-532May 15, 2024 | CVSS6.5v3.1 | EPSS0.269% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |