4.9
CVE-2021-25737
- EPSS 0.93%
- Published 06.09.2021 12:15:07
- Last modified 21.11.2024 05:55:19
- Source jordan@liggitt.net
- Teams watchlist Login
- Open Login
A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.
Data is provided by the National Vulnerability Database (NVD)
Kubernetes ≫ Kubernetes Version >= 1.16.0 < 1.18.19
Kubernetes ≫ Kubernetes Version >= 1.19.0 < 1.19.10
Kubernetes ≫ Kubernetes Version >= 1.20.0 < 1.20.7
Kubernetes ≫ Kubernetes Version1.21.0 Update-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.93% | 0.753 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 4.8 | 1.7 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
|
| nvd@nist.gov | 4.9 | 6.8 | 4.9 |
AV:N/AC:M/Au:S/C:P/I:P/A:N
|
| jordan@liggitt.net | 2.7 | 1.2 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
|
CWE-184 Incomplete List of Disallowed Inputs
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.