9.6
CVE-2017-1002101
- EPSS 31.97%
- Published 13.03.2018 17:29:00
- Last modified 21.11.2024 03:04:58
- Source jordan@liggitt.net
- Teams watchlist Login
- Open Login
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.
Data is provided by the National Vulnerability Database (NVD)
Kubernetes ≫ Kubernetes Version >= 1.3.0 <= 1.3.10
Kubernetes ≫ Kubernetes Version >= 1.4.0 <= 1.4.12
Kubernetes ≫ Kubernetes Version >= 1.5.0 <= 1.5.8
Kubernetes ≫ Kubernetes Version >= 1.6.0 <= 1.6.13
Kubernetes ≫ Kubernetes Version >= 1.7.0 < 1.7.14
Kubernetes ≫ Kubernetes Version >= 1.8.0 < 1.8.9
Kubernetes ≫ Kubernetes Version >= 1.9.0 < 1.9.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 31.97% | 0.967 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 9.6 | 3.1 | 5.8 |
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
|
| nvd@nist.gov | 5.5 | 8 | 4.9 |
AV:N/AC:L/Au:S/C:P/I:P/A:N
|
| jordan@liggitt.net | 8.8 | 2.8 | 5.9 |
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-59 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.