Id:
CVE-2017-1002101
Comment
:
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.
CVSSv2 Score:
5.5
Access vector:
|
NETWORK
|
Access complexity:
|
LOW
|
Authentication:
|
SINGLE
|
Confidentiality impact:
|
PARTIAL
|
Integrity impact:
|
PARTIAL
|
Availability impact:
|
NONE
|
CVSSv2 Vector:
AV:N/AC:L/Au:S/C:P/I:P/A:N
CVSSv3 Score:
9.6
Attack vector:
|
NETWORK
|
Attack complexity:
|
LOW
|
Privileges required:
|
LOW
|
User interaction:
|
NONE
|
Scope:
|
CHANGED
|
Confidentiality impact:
|
HIGH
|
Integrity impact:
|
HIGH
|
Availability impact:
|
NONE
|
CVSSv3 Vector:
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
References: