Vulnerability · Published Jan 14, 2023 · Assigned by GitHub_M
CVE-2023-22480KubeOperator is vulnerable to unauthorized access to system API
High 7.3
In plain English
A high-severity security flaw in KubeOperator from KubeOperator. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 66.8% (higher than 99.3% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/KubeOperator/KubeOperator | no fix listed | GHSA-jxgp-jgh3-8jc8 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| KubeOperator | KubeOperator | <= 3.16.3 |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L