Riskcovery

CVE-2020-8568

Kubernetes Secrets Store CSI Driver sync/rotate directory traversal

State
Published
Severity
5.8 Medium
Published
Jan 21, 2021
Updated
Sep 17, 2024
Reserved
Feb 3, 2020

Read the record on cve.org

Description

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.

Scores

CVSSScoreVectorSource
3.15.8 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:Nkubernetes

Weaknesses

  • CWE-24 Path Traversal: '../filedir'
  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
Kubernetes Secrets Store CSI DriverKubernetes
  • Kubernetes Secrets Store CSI Driver v0.0.15Affected
  • Kubernetes Secrets Store CSI Driver v0.0.16Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.