high7.5
CVE-2018-18264
Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster.
Impact
Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kubernetes | Dashboard | before 1.10.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/106493
- https://github.com/kubernetes/dashboard/pull/3289
- https://github.com/kubernetes/dashboard/pull/3400
- https://github.com/kubernetes/dashboard/releases/tag/v1.10.1
- https://groups.google.com/forum/#%21topic/kubernetes-announce/yBrFf5nmvfI
- https://sysdig.com/blog/privilege-escalation-kubernetes-dashboard/
- http://www.securityfocus.com/bid/106493
- https://github.com/kubernetes/dashboard/pull/3289
- https://github.com/kubernetes/dashboard/pull/3400
- https://github.com/kubernetes/dashboard/releases/tag/v1.10.1
- https://groups.google.com/forum/#%21topic/kubernetes-announce/yBrFf5nmvfI
- https://sysdig.com/blog/privilege-escalation-kubernetes-dashboard/