Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2020-8567

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.

VectorNETWORK

PublishedJan 21, 2021, 17:15

Published Byjordan@liggitt.net

Base Score

Score6.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/hashicorp/vault-csi-provider(Go)00.0.6N/A

github.com/Azure/secrets-store-csi-driver-provider-azure(Go)00.0.10N/A

github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp(Go)00.2.0N/A

References

https://github.com/kubernetes-sigs/secrets-store-csi-driver/issues/384
https://groups.google.com/g/kubernetes-secrets-store-csi-driver/c/BI2qisiNXHY

Weakness Type

CWE-22

CVSS Metrics

Base Score

6.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK