6.5
CVE-2021-25735
- EPSS 23.14%
- Published 06.09.2021 12:15:07
- Last modified 21.11.2024 05:55:19
- Source jordan@liggitt.net
- Teams watchlist Login
- Open Login
A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.
Data is provided by the National Vulnerability Database (NVD)
Kubernetes ≫ Kubernetes Version < 1.18.18
Kubernetes ≫ Kubernetes Version >= 1.19.0 < 1.19.10
Kubernetes ≫ Kubernetes Version >= 1.20.0 < 1.20.6
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 23.14% | 0.957 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 1.2 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
|
| nvd@nist.gov | 5.5 | 8 | 4.9 |
AV:N/AC:L/Au:S/C:N/I:P/A:P
|
| jordan@liggitt.net | 6.5 | 1.2 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
|
CWE-372 Incomplete Internal State Distinction
The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.