DNS Rebinding in etcd · CVE-2018-1099 · GitHub Advisory Database · GitHub

DNS Rebinding in etcd

Moderate severity GitHub Reviewed Published Feb 15, 2022 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

go.etcd.io/etcd (Go)

Affected versions

< 3.4.0

Patched versions

3.4.0

Description

DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).

References

Reviewed May 19, 2021

Published to the GitHub Advisory Database Feb 15, 2022

Last updated Jan 9, 2023

Severity

Moderate

5.5

/ 10

CVSS base metrics

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N