CVE-2024-5154

HighCVSS 8.1/10Last modified Nov 4, 2026

Description

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
——>= 1.30.0, < 1.30.1; >= 1.29.4, < 1.29.5; >= 1.28.6, < 1.28.7
Red HatRed Hat OpenShift Container Platform 4.12—
Red HatRed Hat OpenShift Container Platform 4.13—
Red HatRed Hat OpenShift Container Platform 4.14—
Red HatRed Hat OpenShift Container Platform 4.15—
Red HatRed Hat OpenShift Container Platform 4.16—
Red HatRed Hat OpenShift Container Platform 4.16—
Red HatRed Hat OpenShift Container Platform 4.16—
Red HatRed Hat OpenShift Container Platform 4.17—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat OpenShift Container Platform 3.11—

References

Timeline

Published
Jun 12, 2024
Last modified
Nov 4, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-515406.5Dell ECS, versions prior to 3.8.1.3 contains an arithmetic overflow vulnerability exists in retention period handling of ECS. An authenticatCVE-2024-515417.5Local File Inclusion vulnerabilities allow access to sensitive system information.  Affected products: ABB ASPECT - Enterprise v3.08.02; CVE-2024-515428.2Configuration Download vulnerabilities allow access to dependency configuration information.  Affected products: ABB ASPECT - Enterprise vCVE-2024-515437.5Information Disclosure vulnerabilities allow access to application configuration information.  Affected products: ABB ASPECT - Enterprise CVE-2024-515448.2Service Control vulnerabilities allow access to service restart requests and vm configuration settings.  Affected products: ABB ASPECT - ECVE-2024-515459.8Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions.  Affected products: CVE-2024-515467.5Credentials Disclosure vulnerabilities allow access to on board project back-up bundles.  Affected products: ABB ASPECT - Enterprise v3.08CVE-2024-515479.8Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-EnterpriCVE-2024-515488.8Dangerous File Upload vulnerabilities allow upload of malicious scripts.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS SeriCVE-2024-515499.4Absolute File Traversal vulnerabilities allows access and modification of un-intended resources.  Affected products: ABB ASPECT - EnterprCVE-2024-51556.1The Inquiry cart WordPress plugin through 3.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whCVE-2024-515509.8Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device.  A
CVE-2024-5154: High severity, CVSS 8.1 | Vulnix