Information Disclosure

2024-01-0508:09:53

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

kruise-daemon

vulnerability

unauthorized access

cluster secrets

information disclosure

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

Low

EPSS

0.001

Percentile

19.4%

JSON

Kruise-daemon is vulnerable to Information Disclosure. The vulnerability is due to improper access to root privileges on the node where the kruise-daemon runs. This issue can be exploited by an attacker with root privileges to where the kruise-daemon runs to list all the secrets in the entire cluster leading to Information Disclosure