CVE-2024-42480CWE-284

Kamaji's RBAC Roles for `etcd` are not disjunct

High · published August 12, 2024

CVSS v3.1
8.1
EPSS
1%
Percentile
49.2
In the wild
Unconfirmed
What it is

Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control planes. This vulnerability is fixed in edge-24.8.2.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00622 · 49.2th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-08-12T15:21Z
EPSS history
Timeline
  • 12 AUG 15:21Z
    Kamaji's RBAC Roles for `etcd` are not disjunct
    cvelistv5