Vulnerabilities > CVE-2024-42480 - Unspecified vulnerability in Clastix Kamaji

CVSS 9.9 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

clastix

critical

NVD

Published: 2024-08-12

Updated: 2024-08-16

Summary

Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control planes. This vulnerability is fixed in edge-24.8.2.

Vulnerable Configurations

Part	Description	Count
Application	Clastix Clastix Kamaji 0.0.1 Clastix Kamaji 0.0.2 Clastix Kamaji 0.1.0 Clastix Kamaji 0.1.1 Clastix Kamaji 0.2.0 Clastix Kamaji 0.2.1 Clastix Kamaji 0.2.2 Clastix Kamaji 0.2.3 Clastix Kamaji 0.3.0 Clastix Kamaji 0.3.1 Clastix Kamaji 0.3.2 Clastix Kamaji 0.3.3 Clastix Kamaji 0.3.4 Clastix Kamaji 0.3.5 Clastix Kamaji 0.3.6 Clastix Kamaji 0.4.0 Clastix Kamaji 0.4.1 Clastix Kamaji 0.4.2 Clastix Kamaji 0.5.0 Clastix Kamaji 0.5.1 Clastix Kamaji 0.6.0 Clastix Kamaji 0.6.1 Clastix Kamaji 1.0.0 Clastix Kamaji Edge-24.7.1 Clastix Kamaji Edge-24.8.1	27

Summary

Vulnerable Configurations

References