CVE-2023-3676
high · 8.8A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
8.8
CVSS
13.2%
EPSS (exploit prob.)
96th
EPSS percentile
2023-10-31
Published
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| kubernetes | kubernetes | < 1.24.17 |
| kubernetes | kubernetes | >= 1.25.0, < 1.25.13 |
| kubernetes | kubernetes | >= 1.26.0, < 1.26.8 |
| kubernetes | kubernetes | >= 1.27.0, < 1.27.5 |
| kubernetes | kubernetes | >= 1.28.0, < 1.28.1 |
| microsoft | windows | all versions |
Check a specific version with /api/v1/cve/match.
References
- https://github.com/kubernetes/kubernetes/issues/119339
- https://groups.google.com/g/kubernetes-security-announce/c/d_fvHZ9a5zc
- https://security.netapp.com/advisory/ntap-20231130-0007/
- https://github.com/kubernetes/kubernetes/issues/119339
- https://groups.google.com/g/kubernetes-security-announce/c/d_fvHZ9a5zc
- https://security.netapp.com/advisory/ntap-20231130-0007/
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2023-3676