critical9.9
CVE-2023-33190
Improper configuration of RBAC permissions obtaining cluster control permissions
Impact
### Summary Improper configuration of RBAC permissions resulted in obtaining cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster. ### Details detail's is disable by publish. ### PoC detail's is disable by publish. ### Impact + sealos public cloud user + CWE-287 Improper Authentication
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/labring/sealos | < 4.2.1-rc4 | 4.2.1-rc4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sealos Project | Sealos | before 4.2.1 Version 4.2.1 |