CVE-2025-24513

Published Mar 25, 2025

Last updated 21 days ago

Kubernetes

NGINX

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-24513 is a security vulnerability found in the ingress-nginx component of Kubernetes. It stems from the ingress-nginx Admission Controller including attacker-provided data in a filename, which leads to a directory traversal vulnerability within the container. This flaw can potentially allow for denial-of-service (DoS) attacks. Furthermore, when combined with other vulnerabilities, it could lead to limited disclosure of Secret objects from the cluster.

Description: A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.
Source: jordan@liggitt.net
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 4.8
Impact score: 2.5
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Severity: MEDIUM

Weaknesses

jordan@liggitt.net: CWE-20

Hype score: Not currently trending

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References