Permissions, Privileges, and Access Controls in Kubernetes - CVE-2023-5528
Published: November 20, 2023
Vulnerability identifier: #VU83309
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2023-5528
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Kubernetes
Affected software:
Kubernetes
Kubernetes
Detailed vulnerability description
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to improper access restrictions. A remote user with ability to create pods and persistent volumes on Windows nodes can obtain admin privileges on those nodes.
The vulnerability affects Kubernetes clusters only, if they are using an in-tree storage plugin for Windows nodes.
How to mitigate CVE-2023-5528
Install updates from vendor's website.