PT-2024-29313 · Alibaba · Aliyuncontainerservice Pouch

Published 2024-09-23 · Updated 2024-09-26 · CVE-2024-41228

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions AliyunContainerService pouch version 1.3.1

Description A symlink following vulnerability in the pouch cp function of AliyunContainerService pouch allows attackers to escalate privileges and write arbitrary files.

Recommendations For AliyunContainerService pouch version 1.3.1, consider disabling the pouch cp function until a patch is available to prevent privilege escalation and arbitrary file writing.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2024-41228

Affected Products

Aliyuncontainerservice Pouch

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-41228 · Security Note
• https://gist.github.com/cafan/68ed2d065a4b9c1c37c70a18077ad27b · Note
• https://twitter.com/VulmonFeeds/status/1838293520202768526 · Twitter Post
• https://twitter.com/cracbot/status/1838820832807993525 · Twitter Post
• https://twitter.com/CVEnew/status/1838240188432110072 · Twitter Post
• https://t.me/cvedetector/6194 · Telegram Post
• https://twitter.com/cracbot/status/1839183186204701110 · Twitter Post