Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-24884

Good to know:

icon

Date: January 29, 2025

kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16.

Severity Score

Related Resources (6)

https://nvd.nist.gov/vuln/detail/CVE-2025-24884
https://pkg.go.dev/vuln/GO-2025-3431
https://github.com/RichardoC/kube-audit-rest
https://github.com/RichardoC/kube-audit-rest/security/advisories/GHSA-hcr5-wv4p-h2g2
https://github.com/RichardoC/kube-audit-rest/commit/db1aa5b867256b0a7bf206544c6981ab068b73dc
https://www.mend.io/vulnerability-database/CVE-2025-24884

Severity Score

Weakness Type (CWE)

Exposure of Sensitive Information to an Unauthorized Actor

CWE-200

Insertion of Sensitive Information into Log File

CWE-532

Improper Removal of Sensitive Information Before Storage or Transfer

CWE-212

Top Fix

icon

Upgrade Version

Upgrade to version github.com/RichardoC/kube-audit-rest - v0.0.0-20250205113217-9df8886b4819;github.com/RichardoC/kube-audit-rest - v0.0.0-20250129191722-db1aa5b86725

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): LOW

Do you need more information?

Contact Us