hwameistor vulnerabilities

Products

• github.com/hwameistor/hwameistor 2

Latest hwameistor CVEs

Newest publication first

1. CVE-2024-45054 Potential Permission Leakage of Cluster Level in hwameistor

   Published 2024-08-28

   Medium·CVSS 6.7 EPSS 0.25%

   Hwameistor is an HA local storage system for cloud-native stateful workloads. This ClusterRole has * verbs of * resources. If a malicious user can access the worker node which has hwameistor's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to...

2. CVE-2024-36534 Insecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

   Published 2024-07-24

   High·CVSS 8.4 EPSS 0.19%

   Insecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.