An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade kubevirt-virt-handlerUpgrade kubevirt-virt-exportserverUpgrade kubevirt-virt-apiUpgrade kubevirt-virt-launcherUpgrade kubevirt-manifestsUpgrade kubevirt-virt-controllerUpgrade kubevirt-virt-exportproxyUpgrade kubevirt-testsUpgrade obs-service-kubevirt_containers_metaUpgrade kubevirt-pr-helper-confUpgrade kubevirt-virtctlUpgrade kubevirt-virt-operatorUpgrade kubevirt-container-disk | Jul 1, 2024 | May 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
