Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:43412
HistorySep 28, 2023 - 5:55 a.m.

Missing Authentication For Critical Function

2023-09-2805:55:14
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
6
github
cilium
missing authentication
critical function
vulnerability
policy
namespace restrictions
endpointselector
authentication vulnerability
security issue

8.1 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

0.0004 Low

EPSS

Percentile

5.2%

github.com/cilium/cilium is vulnerable to Missing Authentication. The vulnerability is due to the ValidateCNP function in validator.go which lacks checks for a policy with any malicious or incorrectly match configurations, allowing an attacker to create policies that bypass namespace restrictions and affect the entire Cilium cluster when using a crafted endpointSelector that uses the DoesNotExist operator on the reserved:init label.

8.1 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

0.0004 Low

EPSS

Percentile

5.2%

Related for VERACODE:43412