CVE-2023-32082CWE-200

etcd key name can be accessed via LeaseTimeToLive API

Low · published May 11, 2023

CVSS v3.1
3.1
EPSS
1%
Percentile
54.2
In the wild
Unconfirmed
What it is

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00744 · 54.2th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-05-11T19:22Z
EPSS history
Timeline
  • 11 MAY 19:22Z
    etcd key name can be accessed via LeaseTimeToLive API
    cvelistv5