medium6.5
CVE-2023-30512
CubeFS allows Kubernetes cluster-level privilege escalation
Impact
CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thus list all secrets, including the admin secret.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/cubefs/cubefs | <= 3.2.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linuxfoundation | Cubefs | through 3.2.1 |