CVE-2024-12582

Summary

CVE-2024-12582: A vulnerability was discovered in the skupper console, which is a read-only interface used to view network details and metrics for a hybrid multi-cloud application. The default authentication method for the "admin" user generates and persists a random password in either a Kubernetes secret or a podman volume in plaintext. An attacker can exploit this weakness and gain access to user-readable files in the container filesystem, leading to data confidentiality concerns. Furthermore, the attacker may cause skupper to read excessively large files into memory, resulting in resource exhaustion and potential denial of service attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.