Lucene search

MirantisCVELIST:CVE-2022-0270

HistoryJan 25, 2022 - 7:11 p.m.

CVE-2022-0270 Improper header sanitization in bored-agent causes escalation of privilege

2022-01-2519:11:09

CWE-284

Mirantis

www.cve.org

cve-2022-0270

header sanitization

bored-agent

escalation of privilege

kubernetes impersonation

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.

CNA Affected

[
  {
    "product": "bored-agent",
    "vendor": "Mirantis",
    "versions": [
      {
        "lessThan": "0.6.1",
        "status": "affected",
        "version": "0.6",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/Mirantis/security/blob/main/advisories/0004.md

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

Related for CVELIST:CVE-2022-0270