PT-2023-3436 · Sealos · Sealos
Dvkunion
·
Publicado
2023-05-26
·
Atualizado
2023-07-07
·
CVE-2023-33190
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Sealos versions prior to 4.2.1-rc4
Description
The issue is related to an improper configuration of role-based access control (RBAC) permissions in Sealos, an open-source cloud operating system distribution based on the Kubernetes kernel. This configuration flaw allows an attacker to obtain cluster control permissions, potentially controlling the entire cluster, hundreds of pods, and other resources within the cluster. The estimated number of potentially affected devices is not specified.
Recommendations
For Sealos versions prior to 4.2.1-rc4, upgrade to version 4.2.1-rc4 or later to address the issue. As a temporary workaround, consider restricting access to RBAC permissions to minimize the risk of exploitation. There are no known workarounds for this issue other than upgrading to the fixed version.
Exploit
Correção
Improper Authentication
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Sealos