Riskcovery

CVE-2020-8555

Kubernetes kube-controller-manager SSRF

State
Published
Severity
6.3 Medium
Published
Jun 4, 2020
Updated
Sep 16, 2024
Reserved
Feb 3, 2020

Read the record on cve.org

Description

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).

Scores

CVSSScoreVectorSource
3.16.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:Nkubernetes

Weaknesses

  • CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

ProductVersions
KubernetesKubernetes
  • 1.18.0Affected
  • 1.1Affected
  • 1.2Affected
  • 1.3Affected
  • 1.4Affected
  • 1.5Affected
  • 1.6Affected
  • 1.7Affected
  • 1.8Affected
  • 1.9Affected
  • 1.10Affected
  • 1.11Affected
  • 1.12Affected
  • 1.13Affected
  • 1.14Affected
  • 1.15 to before 1.15.12Affected
  • 1.16 to before 1.16.9Affected
  • 1.17 to before 1.17.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.