6.5
CVE-2023-2728
- EPSS 4.35%
- Published 03.07.2023 21:15:09
- Last modified 13.02.2025 17:16:22
- Source jordan@liggitt.net
- Teams watchlist Login
- Open Login
Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.
Data is provided by the National Vulnerability Database (NVD)
Kubernetes ≫ Kubernetes Version <= 1.24.14
Kubernetes ≫ Kubernetes Version >= 1.25.0 <= 1.25.10
Kubernetes ≫ Kubernetes Version >= 1.26.0 <= 1.26.5
Kubernetes ≫ Kubernetes Version >= 1.27.0 <= 1.27.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 4.35% | 0.884 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 1.2 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
|
| jordan@liggitt.net | 6.5 | 1.2 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.