CVE-2023-33190
Improper configuration of RBAC permissions obtaining cluster control permissions
9.9
CRITICAL
CVSS 3.1
EPSS 0.22%
Description
### Summary Improper configuration of RBAC permissions resulted in obtaining cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster. ### Details detail's is disable by publish. ### PoC detail's is disable by publish. ### Impact + sealos public cloud user + CWE-287 Improper Authentication
How to fix CVE-2023-33190
To remediate CVE-2023-33190, upgrade the affected package to a fixed version below.
- —upgrade to 4.2.1-rc4 or later
Is CVE-2023-33190 being exploited?
Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 4.2.1-rc4
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |