Incorrect Access Control

2024-05-0209:59:26

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

spiderpool

access control

vulnerability

arbitrary code

kubernetes cluster

7.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

github.com/spidernet-io/spiderpool is vulnerable to Incorrect access control. The vulnerability is due to improper clusterRole configurations, which allows a local attackers to execute arbitrary code by using crafted commands to access token components, potentially compromising the entire Kubernetes cluster.

CPENameOperatorVersion
github.com/spidernet-io/spiderpoollev0.9.3
github.com/spidernet-io/spiderpoollev0.9.3

CPE	Name	Operator	Version
	github.com/spidernet-io/spiderpool	le	v0.9.3
	github.com/spidernet-io/spiderpool	le	v0.9.3

References

gist.github.com/HouqiyuA/fdb09caea44c80a5681ca1d30bcd6777

github.com/spidernet-io/spiderpool/issues/3361

github.com/spidernet-io/spiderpool/issues/3420

github.com/spidernet-io/spiderpool/pull/3446