x/vulndb: potential Go vuln in github.com/openshift/console: GHSA-69x5-hjg4-m267

[GoVulnBot]

Advisory GHSA-69x5-hjg4-m267 references a vulnerability in the following Go modules:

Module
github.com/openshift/console

Description:
A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112 Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ../ and valid directory paths.

References:

• ADVISORY: GHSA-69x5-hjg4-m267
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-7631
• WEB: https://access.redhat.com/security/cve/CVE-2024-7631
• WEB: https://bugzilla.redhat.com/show_bug.cgi?id=2296053

Cross references:

• github.com/openshift/console appears in 4 other report(s):
  • data/excluded/GO-2023-2208.yaml (x/vulndb: potential Go vuln in github.com/openshift/console: CVE-2018-10937 #2208) LEGACY_FALSE_POSITIVE
  • data/reports/GO-2024-3083.yaml (x/vulndb: potential Go vuln in github.com/openshift/console: GHSA-4crf-28c7-v4gr #3083)
  • data/reports/GO-2024-3211.yaml (x/vulndb: potential Go vuln in github.com/openshift/console: CVE-2024-50312 #3211)
  • data/reports/GO-2024-3289.yaml (x/vulndb: potential Go vuln in github.com/openshift/console: GHSA-v3w7-g6p2-mpx7 #3289)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/openshift/console
      vulnerable_at: 6.0.6+incompatible
summary: OpenShift Console Has a Path Traversal Vulnerability in github.com/openshift/console
cves:
    - CVE-2024-7631
ghsas:
    - GHSA-69x5-hjg4-m267
references:
    - advisory: https://github.com/advisories/GHSA-69x5-hjg4-m267
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-7631
    - web: https://access.redhat.com/security/cve/CVE-2024-7631
    - web: https://bugzilla.redhat.com/show_bug.cgi?id=2296053
source:
    id: GHSA-69x5-hjg4-m267
    created: 2025-03-20T19:01:26.803457528Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/660559 mentions this issue: data/reports: add 28 reports