CVE-2024-4369

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

An information disclosure flaw was found in OpenShift's internal image registry operator. The AZURE_CLIENT_SECRET can be exposed through an environment variable defined in the pod definition, but is limited to Azure environments. An attacker controlling an account that has high enough permissions to obtain pod information from the openshift-image-registry namespace could use this obtained client secret to perform actions as the registry operator's Azure service account.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-526

Affected software

No affected versions have been published.

Timeline

Published
May 1, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-436908.0Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perCVE-2024-436929.8An attacker can directly request the ProGauge MAGLINK LX CONSOLE resource sub page with full privileges by requesting the URL directly.CVE-2024-436939.8A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commaCVE-2024-436946.5In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. This allows for complete CVE-2024-436965.5in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS by memory leak.CVE-2024-436975.5in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through improper input.CVE-2024-436989.8Kieback & Peter's DDC4000 series uses weak credentials, which may allow an unauthenticated attacker to get full admin rights on the system.CVE-2024-436999.8Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to eCVE-2024-43705.4The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgCVE-2024-437007.8xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow CVE-2024-437017.8Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.CVE-2024-437028.1Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical