8

CVE-2023-1260

Kube-apiserver: privesc

An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Kubernetes ≫ Kube-apiserver Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.57% 0.723
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8 1.3 6
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
secalert@redhat.com 8 1.3 6
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-288 Authentication Bypass Using an Alternate Path or Channel

The product requires authentication, but the product has an alternate path or channel that does not require authentication.

https://access.redhat.com/errata/RHSA-2023:3976
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:4093
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:4312
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:4898
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:5008
https://access.redhat.com/security/cve/CVE-2023-1260
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2176267
Third Party Advisory
Issue Tracking
https://github.com/advisories/GHSA-92hx-3mh6-hc49
https://security.netapp.com/advisory/ntap-20231020-0010/
Third Party Advisory