An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Suse | — | Upgrade kubevirt-pr-helper-confUpgrade kubevirt-virt-controllerUpgrade kubevirt-testsUpgrade kubevirt-virtctlUpgrade kubevirt-virt-operatorUpgrade kubevirt-virt-exportproxyUpgrade kubevirt-container-diskUpgrade obs-service-kubevirt_containers_metaUpgrade kubevirt-virt-launcherUpgrade kubevirt-virt-apiUpgrade kubevirt-manifestsUpgrade kubevirt-virt-exportserverUpgrade kubevirt-virt-handler | Jul 1, 2024 | May 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
