CVE-2025-24513

Published Mar 25, 2025

Last updated a day ago

Kubernetes

NGINX

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-24513 is a security vulnerability found in the ingress-nginx component of Kubernetes. It stems from the ingress-nginx Admission Controller including attacker-provided data in a filename, which leads to a directory traversal vulnerability within the container. This flaw can potentially allow for denial-of-service (DoS) attacks. Furthermore, when combined with other vulnerabilities, it could lead to limited disclosure of Secret objects from the cluster.

Description: A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.
Source: jordan@liggitt.net
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 4.8
Impact score: 2.5
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Severity: MEDIUM

Weaknesses

jordan@liggitt.net: CWE-20

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 34

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References