CVE-2020-8567CWE-24

Kubernetes Secrets Store CSI Driver plugin directory traversals

Medium · published January 21, 2021

CVSS v3.1
4.9
EPSS
1%
Percentile
73.9
In the wild
Unconfirmed
What it is

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01492 · 73.9th percentile
Weakness
CWE-24 · Path Traversal: '../filedir'
Published
2021-01-21T17:09Z
EPSS history
Timeline
  • 21 JAN 17:09Z
    Kubernetes Secrets Store CSI Driver plugin directory traversals
    cvelistv5