Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:28970
HistoryJan 12, 2021 - 7:12 a.m.

Insecure Permissions

2021-01-1207:12:12
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
12
github
openshift
machine-config-operator
file permissions
kubeconfig
attacker
container
cluster

EPSS

0

Percentile

12.6%

github.com/openshift/machine-config-operator uses insecure file permissions. The permissions of the file /etc/kubernetes/kubeconfig is overly permissive. An attacker with access to a running container that mounts /etc/kubernetes or has local access to the node will be able to copy the kubeconfig file and attempt to add their own rogue node to the OpenShift cluster.

EPSS

0

Percentile

12.6%

Related for VERACODE:28970