Access Restriction Bypass

2022-11-2806:35:39

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

access restriction bypass

kubeview

default function

api.js

authentication bypass

certificate files

kube-admin

0.013 Low

EPSS

Percentile

85.6%

JSON

kubeview is vulnerable to access restriction bypass. The vulnerability exists in default function of api.js, because api/scrape/kube-system does not require authentication which allows an attacker to bypass the restrictions and retrieve certificate files that can be used to authenticate as kube-admin.

CPENameOperatorVersion
kubevieweq0.1.9
kubevieweq0.1.9

CPE	Name	Operator	Version
	kubeview	eq	0.1.9
	kubeview	eq	0.1.9

References

github.com/advisories/GHSA-22vc-5pgw-644q

github.com/benc-uk/kubeview/blob/master/web/client/src/mixins/api.js#L14

github.com/benc-uk/kubeview/issues/95

0.013 Low

EPSS

Percentile

85.6%

JSON

Related for VERACODE:38271