The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
- CVSS 3.0 Base Score: 5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade k3s | Aug 22, 2024 | Aug 29, 2019 |
| Debian | — | Upgrade kubernetes | Jul 30, 2024 | Aug 29, 2019 |
| Kubernetes | — | Upgrade Kubernetes to version 1.15.2Upgrade Kubernetes to version 1.13.9Upgrade Kubernetes to version 1.14.5 | Sep 11, 2019 | Aug 29, 2019 |
| Oracle_linux | — | Upgrade kubeadmUpgrade kubectlUpgrade kubeadm-ha-setupUpgrade kubernetesUpgrade kubeadm-upgradeUpgrade kubelet | Oct 10, 2019 | Aug 29, 2019 |
| Redhat Openshift | — | Upgrade atomic-openshift-web-consoleUpgrade openshift-enterprise-image-registryUpgrade hawkular-openshift-agentUpgrade cri-oUpgrade openvswitch-ovn-kubernetesUpgrade openshift-eventrouterUpgrade cri-toolsUpgrade golang-github-prometheus-prometheusUpgrade image-inspectorUpgrade atomic-openshift-deschedulerUpgrade ansible-service-brokerUpgrade atomic-openshift-node-problem-detectorUpgrade openshift-external-storageUpgrade atomic-openshift-dockerregistryUpgrade golang-github-openshift-oauth-proxyUpgrade atomic-openshiftUpgrade golang-github-prometheus-alertmanagerUpgrade golang-github-openshift-prometheus-alert-bufferUpgrade golang-github-prometheus-promuUpgrade containernetworking-pluginsUpgrade openshiftUpgrade heapsterUpgrade golang-github-prometheus-node_exporterUpgrade cockpit | Aug 16, 2019 | Aug 5, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub