{"action":"Upgrade github.com/rancher/steve to 0.0.0-20241029132712-2175e090fe4b or later.","affected":[{"introduced":"0"}],"component":"github.com/rancher/steve","cve_ids":["CVE-2024-52280"],"ecosystem":"Go","epss":0.00483,"exploited":false,"fixed_versions":["0.0.0-20241029132712-2175e090fe4b"],"ghsa_id":"GHSA-j5hq-5jcr-xwx7","id":"tcs_01M5KFDGX6WFDKBP22W4C69X69","modified_at":"2026-09-10T03:50:20.815199025Z","published_at":"2024-11-20T18:23:25Z","references":["https://osv.dev/vulnerability/GHSA-j5hq-5jcr-xwx7","https://github.com/rancher/steve/security/advisories/GHSA-j5hq-5jcr-xwx7","https://nvd.nist.gov/vuln/detail/CVE-2024-52280","https://github.com/rancher/steve/commit/2175e090fe4b1e603a54e1cdc5148a2b1c11b4d9","https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-52280","https://github.com/rancher/steve","https://pkg.go.dev/vuln/GO-2024-3281"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-j5hq-5jcr-xwx7","url":"https://osv.dev/vulnerability/GHSA-j5hq-5jcr-xwx7"}],"summary":"github.com/rancher/steve's users can issue watch commands for arbitrary resources"}