CVE-2024-53348
Published: 21 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2024-53348 is an incorrect access control vulnerability (CWE-284) affecting LoxiLB versions 0.9.7 and earlier. LoxiLB is an open-source load balancer, and the flaw allows unauthorized access that exposes sensitive information and enables privilege escalation. The vulnerability received a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high severity due to its potential for remote exploitation with significant confidentiality and integrity impacts.
Remote network-based attackers require no prior privileges (PR:N) or user interaction (UI:N) to exploit the issue, though it demands high attack complexity (AC:H). Exploitation can disclose sensitive data within the LoxiLB environment and allow attackers to escalate their privileges, potentially compromising the load balancer's control plane or associated services.
For mitigation details, including patches or workarounds, refer to the advisory at https://gist.github.com/HouqiyuA/8c734c849c1a9b69ac96c46eba4acbcb and the LoxiLB GitHub repository at https://github.com/loxilb-io/loxilb, published on 2025-03-21.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Vulnerability in public-facing load balancer enables remote unauthorized access (T1190 Exploit Public-Facing Application) resulting in sensitive data disclosure and privilege escalation (T1068 Exploitation for Privilege Escalation).