PT-2025-12435 · Pipecd · Pipecd

Publicado 2025-03-21 · Atualizado 2025-03-28 · CVE-2024-53351

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pipecd version 0.49

Description The issue is related to insecure permissions in pipecd, allowing attackers to gain access to the service account's token. This can lead to escalation of privileges.

Recommendations For pipecd version 0.49, update to a version that addresses the insecure permissions issue to prevent privilege escalation.

Correção

LPE

Improper Access Control

Incorrect Default Permissions

Incorrect Permission

Enumeração de Fraquezas

CWE-284

CWE-276

CWE-732

Identificadores relacionados

CVE-2024-53351

GHSA-4JHW-C53W-W5R7

GO-2025-3546

OPENSUSE-SU-2025:14937-1

Produtos afetados

Pipecd

Referências · 45

• https://github.com/pipe-cd/pipecd · Nota
• https://suse.com/security/cve/CVE-2025-30163 · Nota
• https://suse.com/security/cve/CVE-2025-1974 · Nota
• https://osv.dev/vulnerability/GO-2025-3546 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2024-25132 · Nota
• https://pipecd.dev · Nota
• https://suse.com/security/cve/CVE-2025-30162 · Nota
• https://suse.com/security/cve/CVE-2025-25068 · Nota
• https://twitter.com/CVEnew/status/1903336818818564415 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2025-29923 · Nota
• https://osv.dev/vulnerability/GHSA-4jhw-c53w-w5r7 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-25274 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-53351 · Nota de Segurança
• https://suse.com/security/cve/CVE-2025-24920 · Nota
• https://suse.com/security/cve/CVE-2024-7631 · Nota