CVE-2024-48921

Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0.

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/kyverno/kyverno/security/advisories/GHSA-qjvc-p88j-j9rm	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nirmata:kyverno:*:*:*:*:*:go:*:*

History

07 Nov 2024, 17:20

Type	Values Removed	Values Added
CWE		CWE-863
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 2.7
First Time		Nirmata Nirmata kyverno
CPE		cpe:2.3:a:nirmata:kyverno::::::go::*
References	~~() https://github.com/kyverno/kyverno/security/advisories/GHSA-qjvc-p88j-j9rm -~~	() https://github.com/kyverno/kyverno/security/advisories/GHSA-qjvc-p88j-j9rm - Exploit, Vendor Advisory

01 Nov 2024, 12:57

Type	Values Removed	Values Added
Summary		(es) Kyverno es un motor de políticas diseñado para Kubernetes. Una ClusterPolicy de Kyverno, es decir, "disallow-privileged-containers", se puede anular mediante la creación de una PolicyException en un espacio de nombres aleatorio. Por diseño, las PolicyExceptions se consumen desde cualquier espacio de nombres. Es posible que los administradores no reconozcan que esto permite que los usuarios con privilegios en espacios de nombres que no sean de Kyverno creen excepciones. Esta vulnerabilidad se solucionó en la versión 1.13.0.

29 Oct 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-29 15:15

Updated : 2024-11-07 17:20

NVD link : CVE-2024-48921

Mitre link : CVE-2024-48921

CVE.ORG link : CVE-2024-48921

JSON object : View

Products Affected

nirmata

kyverno

CWE

CWE-863

Incorrect Authorization

CWE-285

Improper Authorization

{"id": "CVE-2024-48921", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 8.7, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "HIGH", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "NONE", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-10-29T15:15:10.593", "references": [{"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-qjvc-p88j-j9rm", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. \"disallow-privileged-containers,\" can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0."}, {"lang": "es", "value": "Kyverno es un motor de pol\u00edticas dise\u00f1ado para Kubernetes. Una ClusterPolicy de Kyverno, es decir, \"disallow-privileged-containers\", se puede anular mediante la creaci\u00f3n de una PolicyException en un espacio de nombres aleatorio. Por dise\u00f1o, las PolicyExceptions se consumen desde cualquier espacio de nombres. Es posible que los administradores no reconozcan que esto permite que los usuarios con privilegios en espacios de nombres que no sean de Kyverno creen excepciones. Esta vulnerabilidad se solucion\u00f3 en la versi\u00f3n 1.13.0."}], "lastModified": "2024-11-07T17:20:34.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nirmata:kyverno:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "4B41BE6A-2077-4112-BB61-4630FFE5D2B5", "versionEndExcluding": "1.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}