Lucene search
RedhatCVELIST:CVE-2023-2250HistoryApr 24, 2023 - 12:00 a.m.
CVE-2023-2250
2023-04-2400:00:00
CWE-268
redhat
www.cve.org
6
open cluster management
worker nodes
cluster-manager
privilege escalation
kubernetes namespaces
EPSS
0
Percentile
9.0%
A flaw was found in the Open Cluster Management (OCM) when a user have access to the worker nodes which has the cluster-manager-registration-controller or cluster-manager deployments. A malicious user can take advantage of this and bind the cluster-admin to any service account or using the service account to list all secrets for all kubernetes namespaces, leading into a cluster-level privilege escalation.
CNA Affected
[
{
"vendor": "n/a",
"product": "MCE",
"versions": [
{
"version": "2.3.0",
"status": "affected"
}
]
}
]Related
veracode
veracode
Privilege Escalation
2023-04-28 02:55:37
cve
cve
CVE-2023-2250
2023-04-24 21:15:09
redhatcve
redhatcve
CVE-2023-2250
2023-04-24 12:45:03
nvd
nvd
CVE-2023-2250
2023-04-24 21:15:09
prion
prion
Design/Logic Flaw
2023-04-24 21:15:00