CVE-2017-1002100 — Sensitive Information Exposure in Kubernetes

CWE-200 — Sensitive Information ExposureCWE-284 — Improper Access Control5 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 49.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
KubernetesDebian Kubernetes
Timeline
PublishedSep 14
Latest updateMay 17

Description

Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the Kubernetes cluster or authenticated access to the Azure portal.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5kubernetes/kubernetesv1.6.0 — unspecified+1
▶NVDkubernetes/kubernetes6 versions+5

Patches

Patch: github.com ↗Patch: groups.google.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-rj88-p797-v9xw: Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1↗2022-05-17
▶

📋Vendor Advisories

2
Red Hat
kubernetes: Incorrect default access permissions for Persistent Volumes↗2017-06-15
▶
Debian
CVE-2017-1002100: kubernetes - Default access permissions for Persistent Volumes (PVs) created by the Kubernete...↗2017
▶

💬Community

1
Bugzilla
CVE-2017-1002100 kubernetes: Incorrect default access permissions for Persistent Volumes↗2017-09-15
▶
CVE-2017-1002100 — Sensitive Information Exposure | cvebase