CVE-2023-29018: fallo de gravedad alta en open-feature-operator
OpenFeature Operator vulnerable to Cluster-level Privilege Escalation
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear open-feature-operator+ Monitorear github.com/open-feature/open-feature-operator
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.1epss 0.7%
The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code execution, an attacker could leverage the lax permissions configured on `open-feature-operator-controller-manager` to escalate the privileges of any SA in the cluster. The increased privileges could be used to modify cluster state, leading to DoS, or read sensitive data, including secrets. Version 0.2.32 mitigates this issue by restricting the resources the `open-feature-operator-controller-manager` can modify.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Productos afectados
open-feature · open-feature-operatorCVEs relacionadas — open-feature-operator
En el mismo producto, de las más peligrosas a las menos.