CVE-2020-8554

kubernetes, oracle communications cloud native core network slice selection function, oracle communications cloud native core policy +1 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2020-8554

Katalog CVE

CVSS 5.0 · Medium EPSS 9,3%

Kerentanan Unverified Ownership pada kubernetes, oracle communications cloud native core network slice selection function +2 lainnya. Skor CVSS 3.1 5.0 (Medium) menurut NVD.

Deskripsi (NVD)

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.

Rincian

Terbit di NVD
21 Januari 2021
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
5.0 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-283: Unverified Ownership
EPSS (30 hari)
9,3% peluang dieksploitasi; lebih tinggi dari 95,2% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
kubernetes kubernetes Semua versi
oracle communications cloud native core network slice selection function Versi 1.2.1
oracle communications cloud native core policy Versi 1.15.0
oracle communications cloud native core service communication proxy Versi 1.14.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.