Vulnerability identifier: #VU76474
Vulnerability risk: Medium
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-20
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Kubernetes
Server applications /
Frameworks for developing and running applications
Vendor:
Description
The vulnerability allows a remote user to execute arbitrary cod on the system.
The vulnerability exists due to users may have access to secure endpoints in the control plane network. A remote user can trigger the vulnerability and allow authenticated requests destined for Nodes to the API server's private network.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
External links
http://github.com/kubernetes/kubernetes/issues/113757
http://groups.google.com/g/kubernetes-security-announce/c/VyPOxF7CIbA
http://security.netapp.com/advisory/ntap-20230505-0007/
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.