Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-4qh7-cr89-jx92

Опубликовано: 22 нояб. 2023
Источник: github
Github: Не прошло ревью
CVSS3: 5.9

Описание

An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.

An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.

EPSS

Процентиль: 47%
0.00242
Низкий

5.9 Medium

CVSS3

Дефекты

CWE-269

Связанные уязвимости

CVSS3: 5.9
ubuntu
около 2 лет назад

An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.

CVSS3: 5.9
nvd
около 2 лет назад

An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.

CVSS3: 5.9
debian
около 2 лет назад

An issue was found with how API keys are created with the Fleet-Server ...

EPSS

Процентиль: 47%
0.00242
Низкий

5.9 Medium

CVSS3

Дефекты

CWE-269