CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
5.7 | $0-$5k | 0.00 |
A vulnerability was found in containernetworking and plugins up to 0.8.5 (Virtualization Software) and classified as critical. This issue affects an unknown code block. The manipulation with an unknown input leads to a channel accessible vulnerability. Using CWE to declare the problem leads to CWE-300. The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint. Impacted is confidentiality, integrity, and availability. The summary by CVE is:
A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.
The weakness was presented 06/03/2020 as not defined bug report (Bugzilla). The advisory is shared at bugzilla.redhat.com. The identification of this vulnerability is CVE-2020-10749 since 03/20/2020. The exploitation is known to be difficult. The attack may be initiated remotely. The requirement for exploitation is a simple authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1557 for this issue.
Upgrading to version 0.8.6 eliminates this vulnerability.
Product
Type
Name
Version
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 6.0VulDB Meta Temp Score: 5.8
VulDB Base Score: 6.0
VulDB Temp Score: 5.7
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 6.0
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Channel accessibleCWE: CWE-300
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: containernetworking/plugins 0.8.6
Timeline
03/20/2020 🔍06/03/2020 🔍
06/04/2020 🔍
10/21/2020 🔍
Sources
Advisory: bugzilla.redhat.comStatus: Not defined
Confirmation: 🔍
CVE: CVE-2020-10749 (🔍)
Entry
Created: 06/04/2020 09:40Updated: 10/21/2020 13:13
Changes: 06/04/2020 09:40 (38), 06/04/2020 09:45 (12), 10/21/2020 13:09 (1), 10/21/2020 13:13 (1)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.