[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2024-7631":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":19,"cwes":20,"cpes":22,"technologies":25,"references":27,"score":34,"epss_score":35,"epss_percentile":36,"is_kev":37,"cisa_kev_date_added":38,"cisa_kev_due_date":38,"cisa_ssvc":39,"attack_mappings":49,"exploits":56},33597,"CVE-2024-7631","EUVD-2025-6761","OpenShift Console Has a Path Traversal Vulnerability\n\nA flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: \u002Flocales\u002Fresources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg\u002Fplugins\u002Fhandlers unsafely.go#L112 Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ..\u002F and valid directory paths.","2025-03-19T21:30:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":17,"userInteraction":17,"attackComplexity":18,"availabilityImpact":17,"privilegesRequired":18,"confidentialityImpact":18},"UNCHANGED","3.1",4.3,"NETWORK","MEDIUM","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","NONE","LOW",true,[21],"CWE-22",[23,24],"cpe:2.3:a:openshift:console:*:*:*:*:*:*:*:*","cpe:2.3:a:openshift:console:6.0.6:*:*:*:*:*:*:*",[26],"Openshift Console",[28,29,30,31,32,33],"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2024-7631","https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2296053","https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-69x5-hjg4-m267","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-7631","https:\u002F\u002Fgithub.com\u002Fopenshift\u002Fconsole","https:\u002F\u002Fpkg.go.dev\u002Fvuln\u002FGO-2025-3539",0.42,0.00511,0.43326,false,null,{"timestamp":40,"automatable":41,"tech_impact":42,"exploitation":43,"cisa_decision":44,"cisa_remediation_timeline":48},"2025-03-19T19:07:23.057581Z","no","partial","none",{"vector":45,"decision":46,"priority":47},"CISAv1\u002FE:N\u002FA:N\u002FT:P\u002FM:H\u002F2026-10-25T17:09:12.620217\u002F","track_star","medium","60D",[50],{"name":51,"source":52,"tactics":53,"technique_id":55},"Exploit Public-Facing Application","attack_vector",[54],"initial-access","T1190",[]]