Skip to main content

Contour CVE-2024-36539

CRITICAL
Insecure Inherited Permissions (CWE-277)
2024-07-24 cve@mitre.org
Information Disclosure Contour Projectcontour
9.8
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jul 24, 2024 - 17:15 cve.org
CRITICAL 9.8

DescriptionCVE.org

Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

AnalysisAI

Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-277. Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. Affected products include: Projectcontour Contour.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Contour

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2021-32783 HIGH
8.5 Jul 23

Contour is a Kubernetes ingress controller using Envoy proxy. Rated high severity (CVSS 8.5), this vulnerability is remo
CVE-2026-41246 HIGH
8.1 Apr 23

Lua code injection in Contour (Kubernetes ingress controller for Envoy) from v1.19.0 through the fixes in v1.31.6/v1.32.
CVE-2020-15127 HIGH
7.5 Aug 05

In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy,

CVE-2023-22834 MEDIUM
4.3 Jun 27

The Contour Service was not checking that users had permission to create an analysis for a given dataset. Rated medium s

Same weakness CWE-277 – Insecure Inherited Permissions

View all
CVE-2024-27822 HIGH POC
7.8
CVE-2023-27842 HIGH POC
8.8
CVE-2025-58437 HIGH POC
8.1
CVE-2025-56019 MEDIUM POC
6.5
CVE-2024-36540 CRITICAL
9.8
CVE-2024-27834 MEDIUM POC
5.5
CVE-2021-24031 MEDIUM POC
5.5
CVE-2018-25111 MEDIUM POC
5.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2024-36539 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy