Kubernetes in OpenShift3 Access Control Misconfiguration · CVE-2015-7561 · GitHub Advisory Database · GitHub

Kubernetes in OpenShift3 Access Control Misconfiguration

Low severity GitHub Reviewed Published May 13, 2022 to the GitHub Advisory Database • Updated Dec 7, 2023

Package

k8s.io/kubernetes (Go)

Affected versions

< 1.2.0-alpha.6

Patched versions

1.2.0-alpha.6

Description

Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.

References

Published by the National Vulnerability Database

Aug 7, 2017

Published to the GitHub Advisory Database May 13, 2022

Reviewed Jul 31, 2023

Last updated Dec 7, 2023

Severity

Low

3.1

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

High

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N