Описание
Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control planes. This vulnerability is fixed in edge-24.8.2.
Ссылки
- Product
- Patch
- ExploitVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до edge-24.8.2 (исключая)
cpe:2.3:a:clastix:kamaji:*:*:*:*:*:*:*:*
EPSS
Процентиль: 62%
0.00425
Низкий
8.1 High
CVSS3
9.9 Critical
CVSS3
Дефекты
CWE-284
NVD-CWE-Other
Связанные уязвимости
CVSS3: 8.1
github
больше 1 года назад
RBAC Roles for `etcd` created by Kamaji are not disjunct
EPSS
Процентиль: 62%
0.00425
Низкий
8.1 High
CVSS3
9.9 Critical
CVSS3
Дефекты
CWE-284
NVD-CWE-Other