CVE-2024-13484
Raw vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-13484 is a high-severity Exposure of Resource to Wrong Sphere (CWE-668) vulnerability. Its CVSS base score is 8.2 (High).
Operationally, ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-13484 is a vulnerability in the openshift-gitops-operator-container, associated with CWE-668. The flaw occurs because the openshift.io/cluster-monitoring label is automatically applied to all namespaces that deploy an ArgoCD Custom Resource (CR) instance. This labeling enables those namespaces to create a rogue PrometheusRule, which is then rolled out cluster-wide due to the label, resulting in adverse effects on the platform monitoring stack.
The vulnerability has a CVSS v3.1 base score of 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Exploitation requires local access and high privileges within the affected OpenShift environment. A privileged attacker can deploy an ArgoCD CR instance in a namespace, trigger the application of the cluster-monitoring label, and create a malicious PrometheusRule that propagates cluster-wide, potentially compromising confidentiality, integrity, and availability of the monitoring stack with high impact.
Red Hat has issued multiple errata addressing this issue, including RHSA-2025:7753, RHSA-2025:8274, and RHSA-2025:9506. Further details on the vulnerability and mitigation steps are available in the Red Hat CVE page at https://access.redhat.com/security/cve/CVE-2024-13484 and the Bugzilla tracker at https://bugzilla.redhat.com/show_bug.cgi?id=2269376.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-0134
Vulnerability Data
A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as…
more
the rule is rolled out cluster-wide when the label is applied.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops resources from being reachable by actors outside the intended control sphere.
Information flow enforcement structurally prevents unintended cross-sphere data or resource exposure.
Least privilege reduces the set of actors that can reach a resource, limiting wrong-sphere exposure.
Security attributes enable correct sphere assignment and subsequent enforcement decisions.
Boundary protection at interfaces prevents resources from being exposed outside authorized spheres.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.