CVEvulnerability

CVE-2023-5528

8.8 HIGH Published 2023-11-14 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2023-11-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20

Description

A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.

Affected configurations

• kubernetes kubernetes (>= 1.8.0 < 1.25.16) • kubernetes kubernetes (>= 1.26.0 < 1.26.11) • kubernetes kubernetes (>= 1.27.0 < 1.27.8) • kubernetes kubernetes (>= 1.28.0 < 1.28.4) • fedoraproject fedora 37 • fedoraproject fedora 38 • fedoraproject fedora 39

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References