PT-2024-27056 · Fabedge · Fabedge

Houqiyua · Published 2024-07-24 · Updated 2024-08-06 · CVE-2024-36536

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions fabedge version 0.8.1

Description The issue concerns insecure permissions in fabedge, allowing attackers to access sensitive data and escalate privileges by obtaining the service account's token.

Recommendations For fabedge version 0.8.1, update to a version that addresses the insecure permissions issue to prevent attackers from accessing sensitive data and escalating privileges.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-36536

GHSA-C9CM-5J82-M6PJ

GO-2024-3027

Affected Products

Fabedge

References · 10

• https://osv.dev/vulnerability/GO-2024-3027 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c9cm-5j82-m6pj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36536 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36536 · Vendor Advisory
• https://github.com/fabedge/fabedge · Note
• https://t.me/cvedetector/1589 · Telegram Post
• https://t.me/cvenotify/87371 · Telegram Post
• https://pkg.go.dev/vuln/GO-2024-3027 · Note
• https://gist.github.com/HouqiyuA/381f100f2ba82a8ada03994aac5bb2e8 · Note
• https://github.com/advisories/GHSA-c9cm-5j82-m6pj · Note