PT-2024-27055 · Meshery · Meshery

Houqiyua · CVE-2024-36535 · Published 2024-07-24 · Updated 2025-09-03

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions meshery version 0.7.51

Description The issue allows attackers to access sensitive data and escalate privileges by obtaining the service account's token due to insecure permissions.

Recommendations For meshery version 0.7.51, update to a version that addresses the insecure permissions issue to prevent attackers from accessing sensitive data and escalating privileges.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-36535

Affected Products

Meshery

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36535.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-36535 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36535 · Security Note
• https://t.me/cveNotify/134235 · Telegram Post
• https://gist.github.com/HouqiyuA/2950c3993cdeff23afcbd73ba7a33879 · Note
• https://t.me/cvedetector/1597 · Telegram Post