CVE-2017-1002100

EPSS 1.3%

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 1.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

14 Sep 2017Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the Kubernetes cluster or authenticated access to the Azure portal.

Affected products

Kubernetes · Kubernetes

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/kubernetes/kubernetes/issues/47611 https://groups.google.com/d/msg/kubernetes-security-announce/n3VBg_WJZic/-ddIqKXqAAAJ