7.8
CVE-2021-25749
- EPSS 0.04%
- Veröffentlicht 24.05.2023 17:15:09
- Zuletzt bearbeitet 21.11.2024 05:55:20
- Quelle jordan@liggitt.net
- CVE-Watchlists
- Unerledigt
LoginrunAsNonRoot logic bypass for Windows containers
Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Kubernetes ≫ Kubernetes Version >= 1.20.0 <= 1.21.0
Kubernetes ≫ Kubernetes Version >= 1.22.0 < 1.22.14
Kubernetes ≫ Kubernetes Version >= 1.23.0 < 1.23.11
Kubernetes ≫ Kubernetes Version >= 1.24.0 < 1.24.5
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.04% | 0.113 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| jordan@liggitt.net | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-284 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.