Intel

CVE-2024-5154

CVE-2024-5154

highEPSS 1.2%

Description

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.

Source: CVELISTV5NVDCVEORGOSVOSV

Metrics

Severity
high
Priority score
86.57
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
8.1
Source: nvd-v3
CVSS v3
8.1
CVSS v4
—
EPSS percentile
67.3 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
EPSS score
1.2 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2024-06-12 09:15 UTC
CWE
CWE-22

Weakness classes (CWE)

  • CWE-22Base

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-08-21 12:16 UTC· secalert@redhat.com
    • Affected: …, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13 (+10) → …, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13 (+9)

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • kubernetes

    cri-o

  • redhat

    openshift_container_platform

References & sources

IDCVE-2024-5154