CVE-2022-46167

Katalog CVE

CVSS 8.8 · High EPSS 0,94%

Kerentanan Incorrect Authorization pada clastix capsule. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted with `PATCH` capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operator and removing all the enforcement like Pod Security annotations, Network Policies, Limit Range and Resource Quota items. An attacker could detach the Namespace from a Tenant that is forbidding starting privileged Pods using the Pod Security labels by removing the OwnerReference, removing the enforcement labels, and being able to start privileged containers that would be able to start a generic Kubernetes privilege escalation. Patches have been released for version 0.1.3. No known workarounds are available.

Rincian

Terbit di NVD

2 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,94% peluang dieksploitasi; lebih tinggi dari 60,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/clastix/capsule/commit/1df430e71be8c4778c82eca3459978ad7d0b4b7b patch · advisory pihak ketiga
• https://github.com/clastix/capsule/commit/75525ac19254b0c5111e34d7985e2be7bc8b1ac1 patch · advisory pihak ketiga
• https://github.com/clastix/capsule/releases/tag/v0.1.3 patch · release notes · advisory pihak ketiga
• https://github.com/clastix/capsule/security/advisories/GHSA-x45c-cvp8-q4fm advisory pihak ketiga