PT-2025-12435 · Pipecd · Pipecd

Published 2025-03-21 · Updated 2025-03-28 · CVE-2024-53351

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pipecd version 0.49

Description The issue is related to insecure permissions in pipecd, allowing attackers to gain access to the service account's token. This can lead to escalation of privileges.

Recommendations For pipecd version 0.49, update to a version that addresses the insecure permissions issue to prevent privilege escalation.

Fix

LPE

Improper Access Control

Incorrect Default Permissions

Incorrect Permission

Weakness Enumeration

CWE-284

CWE-276

CWE-732

Related Identifiers

CVE-2024-53351

GHSA-4JHW-C53W-W5R7

GO-2025-3546

OPENSUSE-SU-2025:14937-1

Affected Products

Pipecd

References · 45

• https://osv.dev/vulnerability/GO-2025-3546 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4jhw-c53w-w5r7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53351 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53351 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14937-1 · Vendor Advisory
• https://github.com/pipe-cd/pipecd · Note
• https://suse.com/security/cve/CVE-2025-30163 · Note
• https://suse.com/security/cve/CVE-2025-1974 · Note
• https://suse.com/security/cve/CVE-2024-25132 · Note
• https://pipecd.dev · Note
• https://suse.com/security/cve/CVE-2025-30162 · Note
• https://suse.com/security/cve/CVE-2025-25068 · Note
• https://twitter.com/CVEnew/status/1903336818818564415 · Twitter Post
• https://suse.com/security/cve/CVE-2025-29923 · Note
• https://suse.com/security/cve/CVE-2025-25274 · Note