CVE-2024-9858CWE-276

Insecure user permissions in Google Cloud Migrate to Containers for Windows

Medium · published October 16, 2024

CVSS v4.0
5.9
EPSS
0%
Percentile
0.1
In the wild
Unconfirmed
What it is

There exists an insecure default user permission in Google Cloud Migrate to containers from version 1.1.0 to 1.2.2 Windows installs. A local "m2cuser" was greated with administrator privileges. This posed a security risk if the "analyze" or "generate" commands were interrupted or skipping the action to delete the local user “m2cuser”. We recommend upgrading to 1.2.3 or beyond

The record
Technical detail
CVSS v4.0
5.9 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/S:P/AU:Y/R:A/V:D/RE:L/U:Green
EPSS
0.00072 · 0.1th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2024-10-16T08:43Z
EPSS history
Timeline
  • 16 OCT 08:43Z
    Insecure user permissions in Google Cloud Migrate to Containers for Windows
    cvelistv5