GHSA-p26r-gfgc-c47h

KubeSphere IDOR vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-46528

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/kubesphere/kubesphere	>= 4.0.0, < 4.1.3	4.1.3
Go	github.com/kubesphere/kubesphere	>= 3.0.0, < 3.4.1	3.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere v3.4.1 and v4.1.1 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-46528 advisory
https://github.com/kubesphere/kubesphere/issues/6227 web
https://github.com/kubesphere/kubesphere package
https://kubesphere.io web
https://okankurtulus.com.tr/2024/09/09/idor-vulnerability-in-kubesphere web
https://pkg.go.dev/vuln/GO-2024-3248 web
https://www.kubesphere.io/news/kubesphere-cve-2024-46528 web