critical9.8
CVE-2022-45933
KubeView vulnerable to full cluster takeover due to improper authentication
Impact
KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieves certificate files that can be used for authentication as kube-admin. NOTE: the vendor's position is that KubeView was a "fun side project and a learning exercise," and not "very secure."
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/benc-uk/kubeview | <= 0.1.31 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kubeview Project | Kubeview | through 0.1.31 |