CVE-2023-5044

🗓️ 25 Oct 2023 19:19:08Reported by kubernetesType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 235 Views🌐 WEB

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

Reporter	Title	Published	Views	Family All 36
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes Ingress Controller security vulnerabilities (CVE-2023-5043, CVE-2023-5044, CVE-2022-4886)	10 Nov 202309:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Kubernetes ingress-nginx	19 Mar 202423:36	–	ibm
Chainguard	CVE-2023-5044 vulnerabilities	25 Oct 202320:15	–	cgr
Circl	CVE-2023-5044	26 Oct 202300:39	–	circl
CNNVD	Ingress NGINX Controller Code Injection Vulnerability	25 Oct 202300:00	–	cnnvd
Cvelist	CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation	25 Oct 202319:19	–	cvelist
GithubExploit	Exploit for Improper Input Validation in Kubernetes Ingress-Nginx	29 Mar 202418:53	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Kubernetes Ingress-Nginx	17 Jan 202414:32	–	githubexploit
EUVD	EUVD-2023-2727	3 Oct 202520:07	–	euvd
Github Security Blog	Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation	25 Oct 202321:30	–	github

NVD

Node

kubernetes ingress-nginxRange<1.9.0

[
  {
    "vendor": "Kubernetes",
    "product": "ingress-nginx",
    "repo": "https://github.com/kubernetes/ingress-nginx",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.9.0",
        "versionType": "semver"
      },
      {
        "status": "unknown",
        "version": "1.9.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2023/10/25/3
security	www.security.netapp.com/advisory/ntap-20240307-0012/
github	www.github.com/kubernetes/ingress-nginx/issues/10572
groups	www.groups.google.com/g/kubernetes-security-announce/c/ukuYYvRNel0

Parameter	Position	Path	Description	CWE
cmd	query param	/4armed	Exploits CVE-2023-5044 by executing commands via the default /4armed endpoint using the cmd parameter	CWE-94, CWE-20

13 Feb 2025 18:15Current

8.3High risk

Vulners AI Score8.3

CVSS 3.17.6 - 8.8

EPSS0.08939

SSVC