CVE-2024-10220
Published: 22 November 2024
Summary
CVE-2024-10220 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 2.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2024-10220 resides in the Kubernetes kubelet component and permits arbitrary command execution via specially crafted gitRepo volumes. It affects kubelet versions through 1.28.11, 1.29.0 through 1.29.6, and 1.30.0 through 1.30.2, and is classified under CWE-22 with a CVSS 3.1 score of 8.1.
An attacker with low privileges can exploit the flaw over a network connection without user interaction, resulting in high confidentiality and integrity impact on the affected node while availability remains unaffected.
Public advisories and patch information are available via the referenced Kubernetes GitHub issue, the kubernetes-security-announce mailing list post, and the Openwall oss-security archive entry. The associated EPSS score remains flat at a peak of 0.3957 with no material upward trajectory observed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-3336
Vulnerability details
The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.