CVE-2020-8559CWE-601

Privilege escalation from compromised node to cluster

Medium · published July 22, 2020

CVSS v3.1
6.4
EPSS
6%
Percentile
93.4
In the wild
Unconfirmed
What it is

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.06100 · 93.4th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2020-07-22T13:47Z
EPSS history
Timeline
  • 22 JUL 13:47Z
    Privilege escalation from compromised node to cluster
    cvelistv5