CVE-2024-13484

HighCVSS 8.2/10Last modified Jun 26, 2026

Description

A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-668

Affected software

Vendor	Product	Versions
—	—	< 1.13
Red Hat	Red Hat OpenShift GitOps 1.14	—
Red Hat	Red Hat OpenShift GitOps 1.14	—
Red Hat	Red Hat OpenShift GitOps 1.14	—
Red Hat	Red Hat OpenShift GitOps 1.14	—
Red Hat	Red Hat OpenShift GitOps 1.14	—
Red Hat	Red Hat OpenShift GitOps 1.14	—
Red Hat	Red Hat OpenShift GitOps 1.14	—
Red Hat	Red Hat OpenShift GitOps 1.14	—
Red Hat	Red Hat OpenShift GitOps 1.14	—
Red Hat	Red Hat OpenShift GitOps 1.14	—
Red Hat	Red Hat OpenShift GitOps 1.15	—
Red Hat	Red Hat OpenShift GitOps 1.15	—
Red Hat	Red Hat OpenShift GitOps 1.15	—
Red Hat	Red Hat OpenShift GitOps 1.15	—
Red Hat	Red Hat OpenShift GitOps 1.15	—
Red Hat	Red Hat OpenShift GitOps 1.15	—
Red Hat	Red Hat OpenShift GitOps 1.15	—
Red Hat	Red Hat OpenShift GitOps 1.15	—
Red Hat	Red Hat OpenShift GitOps 1.15	—
Red Hat	Red Hat OpenShift GitOps 1.15	—
Red Hat	Red Hat OpenShift GitOps 1.16	—

References

Timeline

Published: Jan 28, 2025
Last modified: Jun 26, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-134857.5The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' pa CVE-2024-134864.8The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2024-134877.3The The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.x plugin for WordPre CVE-2024-134887.5The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' paramete CVE-2024-134897.5The LTL Freight Quotes – Old Dominion Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' p CVE-2024-13495.4The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for Wor CVE-2024-134907.5The LTL Freight Quotes – XPO Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters CVE-2024-134917.5The Small Package Quotes – For Customers of FedEx plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_i CVE-2024-134926.1The Guten Free Options WordPress plugin through 0.9.5 does not sanitise and escape a parameter before outputting it back in the page, leadin CVE-2024-134934.8The Sensly Online Presence WordPress plugin through 0.6 does not sanitise and escape some of its settings, which could allow high privilege CVE-2024-134944.3The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. Thi CVE-2024-134957.3The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to ar