7.8

CVE-2021-25749

runAsNonRoot logic bypass for Windows containers

Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Kubernetes ≫ Kubernetes Version >= 1.20.0 <= 1.21.0
Kubernetes ≫ Kubernetes Version >= 1.22.0 < 1.22.14
Kubernetes ≫ Kubernetes Version >= 1.23.0 < 1.23.11
Kubernetes ≫ Kubernetes Version >= 1.24.0 < 1.24.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.112
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
jordan@liggitt.net 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://groups.google.com/g/kubernetes-security-announce/c/qqTZgulISzA
Mailing List