CVE-2024-7079

MEDIUM

Openshift Container Platform - Unauthenticated Helm Chart Verification Endpoint Access

Title source: llm
STIX 2.1

Description

A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart from a URI that is remote HTTP/HTTPS or local. Access to this endpoint is gated by the authHandlerWithUser() middleware function. Contrary to its name, this middleware function does not verify the validity of the user's credentials. As a result, unauthenticated users can access this endpoint.

References (2)

Core 2
Core References
Vendor Advisory vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2024-7079
Issue Tracking issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2299678

Scores

CVSS v3 6.5
EPSS 0.0034
EPSS Percentile 57.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-306
Status published
Products (2)
redhat/openshift_container_platform 3.11
redhat/openshift_container_platform 4.0
Published Jul 24, 2024
Tracked Since Feb 18, 2026