CVE-2019-10223CWE-200

A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1

Medium · published November 5, 2019

CVSS v3.0
5.3
EPSS
2%
Percentile
78.1
In the wild
Unconfirmed
What it is

A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled annotations to be exposed as metrics. By default, the kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default `kubectl` behavior and this new feature can cause the entire secret content to end up in metric labels thus inadvertently exposing the secret content in metrics. This feature has been reverted and released as the v1.7.2 release. If you are running the v1.7.0 or v1.7.1 release, please upgrade to the v1.7.2 release as soon as possible.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01780 · 78.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2019-11-05T11:40Z
EPSS history
Timeline
  • 05 NOV 11:40Z
    A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1
    cvelistv5