GitHub Advisory DatabaseGHSA-JXGP-JGH3-8JC8KubeOperator allows unauthorized access to system API
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.136 Low
EPSS
Percentile
95.7%
Summary
Unauthorized access refers to the ability to bypass the system’s preset permission settings to access some API interfaces. The attack exploits a flaw in how online applications handle routing permissions.
Affected Version
<= v3.16.3
Patches
The vulnerability has been fixed in v3.16.3.
https://github.com/KubeOperator/KubeOperator/commit/7ef42bf1c16900d13e6376f8be5ecdbfdfb44aaf
Workarounds
It is recommended to upgrade the version to v3.16.4.
For more information
If you have any questions or comments about this advisory, please open an issue.
References
https://github.com/KubeOperator/KubeOperator/releases/tag/v3.16.4
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/kubeoperator/kubeoperator | le | 3.16.3 |
References
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.136 Low
EPSS
Percentile
95.7%