PT-2025-22064 · Unknown · Gardener External Dns Management+1

Rfranzke · Published 2025-05-19 · Updated 2025-05-26 · CVE-2025-47282

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Gardener External DNS Management versions prior to 0.23.6 gardener/gardener-extension-shoot-dns-service extension versions <= v1.60.0

Description: A security issue was discovered in Gardener's External DNS Management that could allow a user with administrative privileges for a Gardener project or a shoot cluster to obtain control over the seed cluster. This issue affects all Gardener installations, regardless of the public cloud provider used. The affected component is gardener/external-dns-management. The external-dns-management component may also be deployed on the seeds by the gardener/gardener-extension-shoot-dns-service extension.

Recommendations: For Gardener External DNS Management versions prior to 0.23.6, update to version 0.23.6 to fix the issue. For gardener/gardener-extension-shoot-dns-service extension versions <= v1.60.0, update to a version greater than v1.60.0 to fix the issue. As a temporary workaround, consider restricting access to the gardener/external-dns-management component and the gardener/gardener-extension-shoot-dns-service extension until a patch is applied.

Exploit

Fix

LPE

Improper Privilege Management

RCE

Weakness Enumeration

CWE-269

CWE-20

Related Identifiers

CVE-2025-47282

GHSA-XWGG-M7FX-83WX

GO-2025-3697

OPENSUSE-SU-2025:15159-1

Affected Products

Gardener External Dns Management

Gardener/Gardener-Extension-Shoot-Dns-Service

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47282.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-47282 · Security Note
• https://osv.dev/vulnerability/CVE-2025-47282 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15159-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xwgg-m7fx-83wx · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3697 · Vendor Advisory
• https://github.com/gardener/external-dns-management/security/advisories/GHSA-xwgg-m7fx-83wx · Note
• https://github.com/gardener/external-dns-management · Note
• https://suse.com/security/cve/CVE-2025-47284 · Note
• https://suse.com/security/cve/CVE-2025-47291 · Note
• https://twitter.com/CveFindCom/status/1924526100027162729 · Twitter Post
• https://suse.com/security/cve/CVE-2025-48069 · Note
• https://suse.com/security/cve/CVE-2025-2570 · Note
• https://suse.com/security/cve/CVE-2025-47290 · Note
• https://suse.com/security/cve/CVE-2025-48056 · Note