CVE Update Request: CVE-2024-46528

[smartcat999]

Dear CISA Team,

I am writing to request an update for CVE-2024-46528 in the National Vulnerability Database.

1. CVE ID: CVE-2024-46528

2. Requested Changes:

   a. Confidentiality Impact:

   • Current: High
   • Requested Change: Low

   b. Hyperlink Update:

   • Current: http://kubesphere.com
   • Requested Change: https://kubesphere.io/

   c. Additional Reference:

   • Add: CVE-2024-46528: IDOR security vulnerability  kubesphere/kubesphere#6227

3. Justification for Changes:
   The Confidentiality Impact has been reassessed and determined to be Low based on further analysis of the vulnerability's scope and potential effects. The hyperlink update is to reflect the current official website of KubeSphere. The additional reference provides more detailed information about the vulnerability and its mitigation.

4. Additional Information:

   • Affected Versions:
     KubeSphere 4.x: < 4.1.3
     KubeSphere 3.x: >= 3.0.0, <= 3.4.1
     KubeSphere Enterprise 4.x: < 4.1.3
     KubeSphere Enterprise 3.x: >= 3.0.0, <= 3.5.0
   • The CVSS vector string should be updated to reflect the change in Confidentiality Impact.

[jwoytek-cisa]

Hello @smartcat999 and thank you for the updates. It looks like our Vulnrichment data has been updated as requested. However, your request asked for updates to the National Vulnerability Database (NVD). You will need to contact NVD to request any changes to the data that the provide. We can only update CISA Vulnrichment here.