The vulnerability of the karmada-operator and karmadactl packages from the Kubernetes cluster management system allows a hacker to write arbitrary files to the basic file system, enabling them to run cloud applications on multiple Karmada clusters.

The vulnerability of the karmada-operator and karmadactl packages from the Kubernetes cluster management system, which are used to run cloud applications across multiple Karmada clusters, is related to an incorrect path name limitation for accessing the restricted directory. Exploiting this...

CVE-2024-56514: Improper Limitation of a Pathname to a Restricted Directory

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTPs URL to retrieve the custom resourc...