CVE-2023-1260
HIGH EPSS 72.3%
Published Sep 24, 20232y ago · Modified Jun 17, 20261w ago
8.0 CVSS 3.1
Published Sep 24, 2023 2y ago
Last Modified Jun 17, 2026 1w ago
Description
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Attack Vector Network
Attack Complexity High
Privileges Required High
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
72.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-288
Affected Products 5
| Vendor | Product | Version | Range |
|---|---|---|---|
| kubernetes | kube-apiserver | * | any |
| redhat | openshift_container_platform | 4.10 | any |
| redhat | openshift_container_platform | 4.11 | any |
| redhat | openshift_container_platform | 4.12 | any |
| redhat | openshift_container_platform | 4.13 | any |
References 9
- access.redhat.com https://access.redhat.com/errata/RHSA-2023:3976
- access.redhat.com https://access.redhat.com/errata/RHSA-2023:4093
- access.redhat.com https://access.redhat.com/errata/RHSA-2023:4312
- access.redhat.com https://access.redhat.com/errata/RHSA-2023:4898
- access.redhat.com https://access.redhat.com/errata/RHSA-2023:5008
- access.redhat.com https://access.redhat.com/security/cve/CVE-2023-1260
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2176267
- github.com https://github.com/advisories/GHSA-92hx-3mh6-hc49
- security.netapp.com https://security.netapp.com/advisory/ntap-20231020-0010/
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.