CVE-2018-1002103

2022-10-0316:21:40

kubernetes

www.cve.org

minikube

vulnerability

kubernetes dashboard

host filesystem

cve-2018-1002103

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.3%

JSON

In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.

CNA Affected

[
  {
    "product": "Minikube",
    "vendor": "Kubernetes",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "v0.3.0",
        "versionType": "custom"
      },
      {
        "lessThan": "v0.30.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]