CVE-2023-32082lowCWE-200

CVE-2023-32082: falha de baixa gravidade em etcd-io etcd

etcd key name can be accessed via LeaseTimeToLive API

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar etcd+ Monitorar etcd

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.1epss 0.7%
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
etcd-io · etcd
CVEs relacionadas — etcd-io etcd

No mesmo produto, das mais perigosas para as menos.

CVE-2020-15136MEDIUMImproper authentication in etcdEPSS 1.7%CVE-2020-15115MEDIUMNo minimum password length in etcdEPSS 1.3%CVE-2020-15112MEDIUMImproper Input Validation in etcdEPSS 1.3%CVE-2020-15106MEDIUMImproper Input Validation in etcdEPSS 1.3%CVE-2020-15114HIGHDenial of Service in etcdEPSS 1.1%CVE-2026-73499HIGHetcd: Watch API authorization bypass via open-ended range requestsEPSS 0.7%