CVE-2022-45933

CRITICAL9.8EPSS 93.1%

KubeView vulnerable to full cluster takeover due to improper authentication

Published: 11/27/2022Modified: 11/8/2023
Also known as:GHSA-22vc-5pgw-644q

Description

KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieves certificate files that can be used for authentication as kube-admin. NOTE: the vendor's position is that KubeView was a "fun side project and a learning exercise," and not "very secure."

Affected packages (1)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1CRITICAL9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (3)