CVE-2022-45933 - KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieves certificate files that can be used for authentication as kube-admin

Back Back to CVE browser

CRITICAL

KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieves certificate files that can be used for authentication as kube-admin

Published Nov 27, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 51.70%

Description

KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieves certificate files that can be used for authentication as kube-admin. NOTE: the vendor's position is that KubeView was a "fun side project and a learning exercise," and not "very secure."

Affected products

Ecosystem	Package	Introduced	Fixed
Go	github.com/benc-uk/kubeview	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-287

Improper Authentication

CWE-306

Missing Authentication

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7188
Advisory
https://github.com/advisories/GHSA-22vc-5pgw-644q
Advisory
https://github.com/benc-uk/kubeview/issues/95
ExploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-45933

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7188		Advisory
https://github.com/advisories/GHSA-22vc-5pgw-644q		Advisory
https://github.com/benc-uk/kubeview/issues/95		ExploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-45933