CVE-2020-8567: medium-severity vulnerability in Kubernetes Secrets Store CSI Driver
Kubernetes Secrets Store CSI Driver plugin directory traversals
Published · Updated
Follow this CVE+ Monitor Kubernetes Secrets Store CSI Driver+ Monitor github.com/Azure/secrets-store-csi-driver-provider-azure
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.9epss 1.5%
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L
Affected products
Kubernetes · Kubernetes Secrets Store CSI DriverRelated CVEs — Kubernetes Secrets Store CSI Driver
In the same product, most dangerous first.