CVE-2020-8553: The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to…

PriorityP428medium5.9CVSS 3.1

AVNACHPRHUINSUCHIHAN

EPSS

0.89%

55.0th percentile

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
k8s.io	ingress-nginx	>= 0 < 0.28.0	0.28.0
kubernetes	ingress-nginx	< 0.28.0	0.28.0
kubernetes	ingress-nginx	>= unspecified < 0.28.0	0.28.0

CVSS provenance

nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

nvdv2.04.9MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.