kube-apiserver up to 1.24.14/1.25.10/1.26.5/1.27.2 ImagePolicyWebhook Admission Plugin access control

Summaryinfo

A vulnerability has been found in kube-apiserver up to 1.24.14/1.25.10/1.26.5/1.27.2 and classified as critical. This vulnerability affects unknown code of the component ImagePolicyWebhook Admission Plugin. This manipulation causes access control. The identification of this vulnerability is CVE-2023-2727. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in kube-apiserver up to 1.24.14/1.25.10/1.26.5/1.27.2 and classified as critical. Affected by this vulnerability is an unknown part of the component ImagePolicyWebhook Admission Plugin. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was shared 06/15/2023. It is possible to read the advisory at bugzilla.redhat.com. This vulnerability is known as CVE-2023-2727 since 05/16/2023. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 1.24.15, 1.25.11, 1.26.6 or 1.27.3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• kube-apiserver

Version

• 1.24.0
• 1.24.1
• 1.24.2
• 1.24.3
• 1.24.4
• 1.24.5
• 1.24.6
• 1.24.7
• 1.24.8
• 1.24.9
• 1.24.10
• 1.24.11
• 1.24.12
• 1.24.13
• 1.24.14
• 1.25.0
• 1.25.1
• 1.25.2
• 1.25.3
• 1.25.4
• 1.25.5
• 1.25.6
• 1.25.7
• 1.25.8
• 1.25.9
• 1.25.10
• 1.26.0
• 1.26.1
• 1.26.2
• 1.26.3
• 1.26.4
• 1.26.5
• 1.27.0
• 1.27.1
• 1.27.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion