CVE-2024-9858

Name of the Vulnerable Software and Affected Versions: Google Cloud Migrate to Containers versions 1.1.0 through 1.2.2

Description: The issue is related to an insecure default user permission in Google Cloud Migrate to containers. A local user m2cuser is created with administrator privileges, posing a security risk if certain commands are interrupted or if the action to delete the local user m2cuser is skipped. This could impact the confidentiality, integrity, and availability of protected information.

Recommendations: For Google Cloud Migrate to Containers versions 1.1.0 through 1.2.2, upgrade to version 1.2.3 or beyond to resolve the issue. As a temporary workaround, consider deleting the local user m2cuser after use to minimize the risk of exploitation. Restrict access to the m2cuser account to prevent unintended access until the issue is resolved.