CVE-2023-5044

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2023/10/25/3	Mailing List Third Party Advisory
https://github.com/kubernetes/ingress-nginx/issues/10572	Issue Tracking Mitigation Vendor Advisory
https://groups.google.com/g/kubernetes-security-announce/c/ukuYYvRNel0	Mailing List Mitigation
https://security.netapp.com/advisory/ntap-20240307-0012/
http://www.openwall.com/lists/oss-security/2023/10/25/3	Mailing List Third Party Advisory
https://github.com/kubernetes/ingress-nginx/issues/10572	Issue Tracking Mitigation Vendor Advisory
https://groups.google.com/g/kubernetes-security-announce/c/ukuYYvRNel0	Mailing List Mitigation
https://security.netapp.com/advisory/ntap-20240307-0012/

Configurations

Configuration 1 (hide)

cpe:2.3:a:kubernetes:ingress-nginx:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:40

Type	Values Removed	Values Added
References	~~() http://www.openwall.com/lists/oss-security/2023/10/25/3 - Mailing List, Third Party Advisory~~	() http://www.openwall.com/lists/oss-security/2023/10/25/3 - Mailing List, Third Party Advisory
References	~~() https://github.com/kubernetes/ingress-nginx/issues/10572 - Issue Tracking, Mitigation, Vendor Advisory~~	() https://github.com/kubernetes/ingress-nginx/issues/10572 - Issue Tracking, Mitigation, Vendor Advisory
References	~~() https://groups.google.com/g/kubernetes-security-announce/c/ukuYYvRNel0 - Mailing List, Mitigation~~	() https://groups.google.com/g/kubernetes-security-announce/c/ukuYYvRNel0 - Mailing List, Mitigation
References	~~() https://security.netapp.com/advisory/ntap-20240307-0012/ -~~	() https://security.netapp.com/advisory/ntap-20240307-0012/ -
CVSS	v2 : ~~unknown~~ v3 : ~~8.8~~	v2 : unknown v3 : 7.6

07 Mar 2024, 17:15

Type	Values Removed	Values Added
References		() https://security.netapp.com/advisory/ntap-20240307-0012/ -

02 Nov 2023, 17:45

Type	Values Removed	Values Added
References	~~(MISC) http://www.openwall.com/lists/oss-security/2023/10/25/3 -~~	(MISC) http://www.openwall.com/lists/oss-security/2023/10/25/3 - Mailing List, Third Party Advisory
References	~~(MISC) https://groups.google.com/g/kubernetes-security-announce/c/ukuYYvRNel0 -~~	(MISC) https://groups.google.com/g/kubernetes-security-announce/c/ukuYYvRNel0 - Mailing List, Mitigation
References	~~(MISC) https://github.com/kubernetes/ingress-nginx/issues/10572 -~~	(MISC) https://github.com/kubernetes/ingress-nginx/issues/10572 - Issue Tracking, Mitigation, Vendor Advisory
First Time		Kubernetes Kubernetes ingress-nginx
CWE		CWE-94
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
CPE		cpe:2.3:a:kubernetes:ingress-nginx::::::::

25 Oct 2023, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-25 20:15

Updated : 2024-11-21 08:40

NVD link : CVE-2023-5044

Mitre link : CVE-2023-5044

CVE.ORG link : CVE-2023-5044

JSON object : View

Products Affected

kubernetes

ingress-nginx

CWE

CWE-20

Improper Input Validation

CWE-94

Improper Control of Generation of Code ('Code Injection')

7.6 /10