What is the CVSS score of CVE-2024-1485?

CVE-2024-1485 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H. EPSS exploitation probability: 1.6%.

Which versions of Registry Support are affected by CVE-2024-1485?

Organizations using A flaw face notable risk from CVE-2024-1485, a path traversal vulnerability rated CVSS 8.0.. A patch is available.

How to fix or mitigate CVE-2024-1485?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Review file handling controls and restrict upload directories.

Registry Support CVE-2024-1485

HIGH

Path Traversal (CWE-22)

2024-02-14 secalert@redhat.com

Path Traversal Registry Support Openshift Openshift Developer Tools And Services

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 24, 2026 - 12:22 vuln.today

Patch released

Mar 24, 2026 - 12:22 nvd

Patch available

CVE Published

Feb 14, 2024 - 00:15 nvd

HIGH 8.0

DescriptionCVE.org

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.

AnalysisAI

A flaw was found in the decompression function of registry-support. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, no authentication required. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed. Affected products include: Devfile Registry-Support, Redhat Openshift, Redhat Openshift Developer Tools And Services.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.