medium6.5Public exploit code
CVE-2024-46528
KubeSphere IDOR vulnerability
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- KubeSphere 3.4.0 - Insecure Direct Object Reference (IDOR)2025-03-27 · webapps · multiple
Impact
An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere v3.4.1 and v4.1.1 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/kubesphere/kubesphere | >= 4.0.0, < 4.1.3 | 4.1.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| KubeSphere | KubeSphere 4.X | before 4.1.3 |
| 3.X | through 3.4.1 through 3.5.0 | |
| KubeSphere | KubeSphere Enterprise 4.X | before 4.1.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/kubesphere/kubesphere/issues/6227
- https://kubesphere.io/
- https://okankurtulus.com.tr/2024/09/09/idor-vulnerability-in-kubesphere/
- https://www.kubesphere.io/news/kubesphere-cve-2024-46528/
- https://github.com/advisories/GHSA-p26r-gfgc-c47h
- https://nvd.nist.gov/vuln/detail/CVE-2024-46528
- https://okankurtulus.com.tr/2024/09/09/idor-vulnerability-in-kubesphere
- https://kubesphere.io
- https://www.kubesphere.io/news/kubesphere-cve-2024-46528
- https://pkg.go.dev/vuln/GO-2024-3248