Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

CVE-2024-7387

🗓️ 16 Sep 2024 23:58:35Reported by redhatType 
cve
 cve🔗 web.nvd.nist.gov👁 84 Views🌐 WEB

A flaw in openshift/builder allows command injection via path traversal, enabling arbitrary commands execution and escalation of privileges on the node

Related
Affected
Refs
Paths
ReporterTitlePublishedViews
Family
GithubExploit		Exploit for CVE-2024-7387
2 Nov 202505:46
–githubexploit
GithubExploit		Exploit for CVE-2024-7387
2 Nov 202505:46
–githubexploit
GithubExploit		Exploit for CVE-2024-7387
11 Feb 202613:19
–githubexploit
Circl		CVE-2024-7387
17 Sep 202403:04
–circl
CNNVD		Red Hat OpenShift Container Platform 安全漏洞
17 Sep 202400:00
–cnnvd
Cvelist		CVE-2024-7387 Openshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategy
16 Sep 202423:58
–cvelist
EUVD		EUVD-2024-2857
3 Oct 202520:07
–euvd
Github Security Blog		OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer
17 Sep 202400:31
–github
NVD		CVE-2024-7387
17 Sep 202400:15
–nvd
OSV		GHSA-QQV8-PH7F-H3F7 OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer
17 Sep 202400:31
–osv
Rows per page
[
  {
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "0b62633adfa2836465202bc851885e078ec888d1",
        "versionType": "git"
      }
    ],
    "packageName": "openshift/builder",
    "collectionURL": "https://github.com/openshift/builder",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Container Platform 4.12",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "openshift4/ose-docker-builder",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "v4.12.0-202409121032.p1.g609473f.assembly.stream.el8",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openshift:4.12::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Container Platform 4.13",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "openshift4/ose-docker-builder",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "v4.13.0-202409120505.p1.g2c7e99d.assembly.stream.el8",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openshift:4.13::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Container Platform 4.14",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "openshift4/ose-docker-builder",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "v4.14.0-202409111409.p1.g52565ca.assembly.stream.el8",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openshift:4.14::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Container Platform 4.15",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "openshift4/ose-docker-builder",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "v4.15.0-202409101936.p1.ge7749a3.assembly.stream.el8",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openshift:4.15::el8",
      "cpe:/a:redhat:openshift:4.15::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Container Platform 4.16",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "openshift4/ose-docker-builder-rhel9",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "v4.16.0-202409101737.p1.gfee4b58.assembly.stream.el9",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openshift:4.16::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Container Platform 4.17",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "openshift4/ose-docker-builder-rhel9",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "v4.17.0-202409122005.p1.gcfcf3bd.assembly.stream.el9",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openshift:4.17::el9"
    ]
  }
]
ParameterPositionPathDescriptionCWE
destinationDirpathmalicious-buildconfig.yamlSymlink traversal in OpenShift build: mounting a secret to a path that resolves to /usr/bin (destinationDir: usr_bin) overwrites the host's /usr/bin/cp, enabling arbitrary code execution during builds.CWE-250

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
15 Apr 2026 00:35Current
9.8High risk
Vulners AI Score9.8
CVSS 3.19.1
EPSS0.00792
SSVC
CWE-250
vulnerability openshift/builder command injection path traversal docker strategy buildconfig privilege escalation.
84