CVE-2024-13484

Estado: AplazadaAlta (8.2)—

A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Puntuación base: 8.2

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.22%
Percentil entre todas las CVEs puntuadas: 12
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Impacto principalT1565.002 Transmitted Data Manipulationimpact75 %
Impacto secundarioT1499.004 Application or System Exploitationimpact70 %

AV:L + PR:H indica escalada local con privilegios altos. La creación de PrometheusRule maliciosa en el stack de monitoreo cluster-wide implica manipulación de configuración (T1565.002) y potencial DoS de monitoreo (T1499.004).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Filter Network Traffic Execution Prevention Encrypt Sensitive Information Application Isolation and Sandboxing Exploit Protection

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Argoproj — Argocd^AI Redhat — Openshift-gitops-operator-container^AI

CWE

CWE-668

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-13484",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-13484",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-28T18:25:37.752075Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.5
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.13",
              "versionType": "semver"
            }
          ],
          "packageName": "gitops-operator",
          "collectionURL": "https://github.com/redhat-developer/gitops-operator",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.14::el8",
            "cpe:/a:redhat:openshift_gitops:1.14::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.14",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.14.4-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/argocd-rhel8",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.14::el8",
            "cpe:/a:redhat:openshift_gitops:1.14::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.14",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.14.4-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/argocd-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.14::el8",
            "cpe:/a:redhat:openshift_gitops:1.14::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.14",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.14.4-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/argo-rollouts-rhel8",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.14::el8",
            "cpe:/a:redhat:openshift_gitops:1.14::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.14",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.14.4-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/console-plugin-rhel8",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.14::el8",
            "cpe:/a:redhat:openshift_gitops:1.14::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.14",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.14.4-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/dex-rhel8",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.14::el8",
            "cpe:/a:redhat:openshift_gitops:1.14::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.14",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.14.4-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/gitops-operator-bundle",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.14::el8",
            "cpe:/a:redhat:openshift_gitops:1.14::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.14",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.14.4-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/gitops-rhel8",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.14::el8",
            "cpe:/a:redhat:openshift_gitops:1.14::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.14",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.14.4-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/gitops-rhel8-operator",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.14::el8",
            "cpe:/a:redhat:openshift_gitops:1.14::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.14",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.14.4-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/kam-delivery-rhel8",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.14::el8",
            "cpe:/a:redhat:openshift_gitops:1.14::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.14",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.14.4-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/must-gather-rhel8",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.15::el8",
            "cpe:/a:redhat:openshift_gitops:1.15::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.15",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.15.2-4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/argocd-extensions-rhel8",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.15::el8",
            "cpe:/a:redhat:openshift_gitops:1.15::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.15",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.15.2-4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/argocd-rhel8",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.15::el8",
            "cpe:/a:redhat:openshift_gitops:1.15::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.15",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.15.2-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/argocd-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.15::el8",
            "cpe:/a:redhat:openshift_gitops:1.15::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.15",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.15.2-4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/argo-rollouts-rhel8",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.15::el8",
            "cpe:/a:redhat:openshift_gitops:1.15::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.15",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.15.2-4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/console-plugin-rhel8",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.15::el8",
            "cpe:/a:redhat:openshift_gitops:1.15::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.15",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.15.2-4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/dex-rhel8",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.15::el8",
            "cpe:/a:redhat:openshift_gitops:1.15::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.15",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.15.2-4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/gitops-operator-bundle",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.15::el8",
            "cpe:/a:redhat:openshift_gitops:1.15::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.15",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.15.2-4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/gitops-rhel8",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.15::el8",
            "cpe:/a:redhat:openshift_gitops:1.15::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.15",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.15.2-4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/gitops-rhel8-operator",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.15::el8",
            "cpe:/a:redhat:openshift_gitops:1.15::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.15",
          "versions": [
            {
              "status": "unaffected",
              "version": "v1.15.2-4",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/must-gather-rhel8",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1.16::el8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift GitOps 1.16",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.16",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "openshift-gitops-1/gitops-rhel8-operator",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-01-28T18:15:32.537",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:7753",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:8274",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:9506",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2024-13484",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269376",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/redhat-developer/gitops-operator/pull/853",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/redhat-developer/gitops-operator/pull/867",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/redhat-developer/gitops-operator/pull/868",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/redhat-developer/gitops-operator/pull/869",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en ArgoCD. La etiqueta openshift.io/cluster-monitoring se aplica a todos los espacios de nombres que implementan una instancia CR de ArgoCD, lo que permite que el espacio de nombres cree una PrometheusRule no autorizada. Este problema puede tener efectos adversos en la pila de monitoreo de la plataforma, ya que la regla se implementa en todo el clúster cuando se aplica la etiqueta."
    }
  ],
  "lastModified": "2026-06-26T05:16:25.783",
  "sourceIdentifier": "secalert@redhat.com"
}