Skip to main content

Incorrect Permission Assignment for Critical Resource

CVE-2023-30512

Severity Medium
Score 6.5/10

Summary

The package github.com/cubefs/cubefs-csi allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has "cfs-csi-cluster-role" and can thus list all secrets, including the admin secret.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-732 - Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Advisory Timeline

  • Published