{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/openshift/console","packageName":"openshift-console","product":"","source":"CNA: redhat","vendor":"","versions":[{"lessThanOrEqual":"6.0.6","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift3/ose-console","product":"Red Hat OpenShift Container Platform 3.11","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-console","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/openshift/console","product":"github.com/openshift/console","source":"OSV GHSA-69x5-hjg4-m267","vendor":"","versions":[{"events":[{"introduced":"0"},{"last_affected":"6.0.6"}],"lessThanOrEqual":"6.0.6","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2024-7631","cwes":["CWE-22"],"description":"A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112 Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ../ and valid directory paths.","epss":{"date":"2026-11-04","percentile":0.44031,"score":0.00515},"exploits":[],"kev":null,"metrics":[{"score":4.3,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1793802358975,"publishedAt":1742410047721,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2024-7631"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2296053"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/advisories/GHSA-69x5-hjg4-m267"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-69x5-hjg4-m267"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-69x5-hjg4-m267"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Red Hat Product Security does not have any recommended mitigations at this time. Please update to a patched version of the component as soon as it is available."}],"revision":"88423e6782be76d51163e8af1b0bec169a0c3f72511463227eb11dd72f6d5596","sources":[{"modifiedAt":1793802358975,"name":"CNA: redhat","retrievedAt":1793804899730,"url":"https://www.cve.org/CVERecord?id=CVE-2024-7631"},{"modifiedAt":1774472629384,"name":"OSV / GitHub Security Advisories","retrievedAt":1793804901727,"url":"https://osv.dev/vulnerability/GHSA-69x5-hjg4-m267"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793804949248,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-7631"}],"ssvc":{"assessedAt":1742411243057,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Openshift-console: openshift console: path traversal","updatedAt":1793804949248}