CVE-2023-2878 : Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service a

Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs.

Published 2023-06-07 15:15:09

Updated 2023-10-02 17:08:35

Source Kubernetes

View at NVD, CVE.org

Products affected by CVE-2023-2878

Kubernetes » Secrets-store-csi-driver
Versions before (<) 1.3.3
cpe:2.3:a:kubernetes:secrets-store-csi-driver:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 22 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N	2.0	4.0	Kubernetes
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: None Availability: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

https://security.netapp.com/advisory/ntap-20230814-0003/

CVE-2023-2878 Kubernetes Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://github.com/kubernetes/kubernetes/issues/118419

CVE-2023-2878: secrets-store-csi-driver discloses service account tokens in logs · Issue #118419 · kubernetes/kubernetes · GitHub
Exploit;Issue Tracking
https://groups.google.com/g/kubernetes-security-announce/c/5K8ghQHBDdQ/m/Udee6YUgAAAJ

[Security Advisory] CVE-2023-2878: secrets-store-csi-driver discloses service account tokens in logs
Mailing List

Jump to