{"affected":[{"product":"n/a","source":"CNA: mitre","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]},{"defaultStatus":"unknown","product":"karmada","source":"ADP: CISA-ADP","vendor":"karmada-io","versions":[{"lessThanOrEqual":"1.9.0","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2024-33396","cwes":["CWE-284"],"description":"An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. NOTE: The maintainer states that the behavior is intended design and notes that the researcher advisory does not provide evidence of arbitrary code execution.","epss":{"date":"2026-11-09","percentile":0.08181,"score":0.00185},"exploits":[],"kev":null,"metrics":[{"score":8.4,"severity":"high","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794235896335,"publishedAt":1714608000000,"references":[{"source":"CNA: mitre","tags":[],"url":"https://gist.github.com/HouqiyuA/2b56a893c06553013982836abb77ba50"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/github/advisory-database/pull/10318"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://gist.github.com/HouqiyuA/2b56a893c06553013982836abb77ba50"}],"remediation":[],"revision":"63915eaaf868ae9d27676d91a7f7e958681c1a762a751a2f6e541068e58a5b3b","sources":[{"modifiedAt":1794235896335,"name":"CNA: mitre","retrievedAt":1794236901460,"url":"https://www.cve.org/CVERecord?id=CVE-2024-33396"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794236941225,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-33396"}],"ssvc":{"assessedAt":1714680651126,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"CVE-2024-33396","updatedAt":1794236941225}