CVE-2018-1002103

2018-12-0521:00:00

kubernetes

www.cve.org

minikube

vulnerability

kubernetes dashboard

host filesystem

cve-2018-1002103

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

32.3%

JSON

In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.

CNA Affected

[
  {
    "product": "Minikube",
    "vendor": "Kubernetes",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "v0.3.0",
        "versionType": "custom"
      },
      {
        "lessThan": "v0.30.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]