CVE-2024-12582

Estado: AplazadaAlta (7.1)—

A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the "admin" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication method can be manipulated by an attacker, leading to the reading of any user-readable file in the container filesystem, directly impacting data confidentiality. Additionally, the attacker may induce skupper to read extremely large files into memory, resulting in resource exhaustion and a denial of service attack.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Puntuación base: 7.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.51%
Percentil entre todas las CVEs puntuadas: 42
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement85 %
Impacto principalT1552.001 Credentials In Filescredential access80 %
Impacto secundarioT1499.004 Application or System Exploitationimpact75 %

Acceso a red adyacente (AV:N) con privilegios locales (PR:L) en servicio remoto; impacto: lectura de credenciales en ficheros plaintext y DoS por exhausción de memoria.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning User Training Threat Intelligence Program Restrict File and Directory Permissions Privileged Account Management Password Policies

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Skupper — Skupper Console^AI

CWE

CWE-305

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-12582",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-12582",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-16T18:13:55.863080Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.8.3",
              "versionType": "semver"
            }
          ],
          "packageName": "skupper",
          "collectionURL": "https://github.com/skupperproject/skupper/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.8.3-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-config-sync-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.8.3-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-controller-podman-container-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.8.3-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-controller-podman-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.8.3-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-flow-collector-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.8.3-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-operator-bundle",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.7.3-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-router-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.8.3-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-service-controller-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1::el9"
          ],
          "vendor": "Red Hat",
          "product": "Service Interconnect 1 for RHEL 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.8.3-1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "service-interconnect/skupper-site-controller-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Service Interconnect 1",
          "packageName": "skupper-cli",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-12-24T04:15:05.137",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:1413",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2024-12582",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333540",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/skupperproject/skupper/pull/1833",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-305"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the skupper console,  a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the \"admin\" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication method can be manipulated by an attacker, leading to the reading of any user-readable file in the container filesystem, directly impacting data confidentiality. Additionally, the attacker may induce skupper to read extremely large files into memory, resulting in resource exhaustion and a denial of service attack."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en la consola del clúster, una interfaz de solo lectura que muestra la red del clúster, detalles de tráfico y métricas para una aplicación de red que un usuario configura en un entorno híbrido de múltiples nubes. Cuando se utiliza el método de autenticación predeterminado, se genera una contraseña aleatoria para el usuario \"admin\" y se conserva en un secreto de Kubernetes o en un volumen podman en un archivo de texto plano. Este método de autenticación puede ser manipulado por un atacante, lo que lleva a la lectura de cualquier archivo legible por el usuario en el sistema de archivos contenedor, lo que afecta directamente la confidencialidad de los datos. Además, el atacante puede inducir a la recopilación a leer archivos extremadamente grandes en la memoria, lo que provoca el agotamiento de los recursos y un ataque de denegación de servicio."
    }
  ],
  "lastModified": "2026-06-18T09:16:08.700",
  "sourceIdentifier": "secalert@redhat.com"
}