CVE-2018-1002103

In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000

High · published December 5, 2018

CVSS v3.0
8.1
EPSS
1%
Percentile
52.7
In the wild
Unconfirmed
What it is

In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.

The record
Technical detail
CVSS v3.0
8.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00702 · 52.7th percentile
Published
2018-12-05T21:00Z
EPSS history
Timeline
  • 05 DEC 21:00Z
    In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000
    cvelistv5