6.5
CVE-2023-2728
- EPSS 4.35%
- Veröffentlicht 03.07.2023 21:15:09
- Zuletzt bearbeitet 13.02.2025 17:16:22
- Quelle jordan@liggitt.net
- Teams Watchlist Login
- Unerledigt Login
Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Kubernetes ≫ Kubernetes Version <= 1.24.14
Kubernetes ≫ Kubernetes Version >= 1.25.0 <= 1.25.10
Kubernetes ≫ Kubernetes Version >= 1.26.0 <= 1.26.5
Kubernetes ≫ Kubernetes Version >= 1.27.0 <= 1.27.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 4.35% | 0.884 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 1.2 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
|
| jordan@liggitt.net | 6.5 | 1.2 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.