CVE-2018-18264

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets with… (CVE-2018-18264)

Description

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster.

Source: CVELISTV5 NVD

Metrics

Severity

high

97.10

—

no public PoC known

7.5

Source: nvd-v3

CVSS v3

7.5

CVSS v4

—

EPSS percentile

99.3 %

Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).

EPSS score

70.4 %

High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

Published

2019-01-03 01:00 UTC

CWE

—

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

kubernetes
dashboard1.10.1

References & sources

https://sysdig.com/blog/privilege-escalation-kubernetes-dashboard/
x_refsource_MISC
http://www.securityfocus.com/bid/106493
vdb-entryx_refsource_BID
https://groups.google.com/forum/#%21topic/kubernetes-announce/yBrFf5nmvfI
x_refsource_MISC
https://github.com/kubernetes/dashboard/releases/tag/v1.10.1
x_refsource_MISC
https://github.com/kubernetes/dashboard/pull/3400
x_refsource_MISC
https://github.com/kubernetes/dashboard/pull/3289
x_refsource_MISC

IDCVE-2018-18264