Incorrect Permission Assignment for Critical Resource
CVE-2023-30512
Summary
The package github.com/cubefs/cubefs-csi allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has "cfs-csi-cluster-role" and can thus list all secrets, including the admin secret.
- LOW
- NETWORK
- NONE
- UNCHANGED
- NONE
- LOW
- HIGH
- NONE
CWE-732 - Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
References
Advisory Timeline
- Published