{"id":"CVE-2024-7631","title":"A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json","summary":"A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-22"],"published":"2025-03-19","updated":"2026-09-03","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-7631","references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-7631","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2296053","label":"secalert@redhat.com"},{"url":"https://github.com/advisories/GHSA-69x5-hjg4-m267","label":"secalert@redhat.com"}],"tags":["nvd"],"epss":0.00501,"epssPercentile":0.41782,"ingestedAt":"2026-09-03T17:05:58.905Z","slug":"CVE-2024-7631","body":"## Overview\n\nA flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112 Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ../ and valid directory paths.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}