CVE-2017-1000056

Published: Jul 17, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.

Affected (5)

Products: Kubernetes: Kubernetes

Kubernetes

1 product

Kubernetes

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Kubernetes Kubernetes	Version 1.5.0
Kubernetes Kubernetes	Version 1.5.1
Kubernetes Kubernetes	Version 1.5.2
Kubernetes Kubernetes	Version 1.5.3
Kubernetes Kubernetes	Version 1.5.4

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://github.com/kubernetes/kubernetes/issues/43459

Source: cve@mitre.org

MitigationThird Party Advisory

https://github.com/kubernetes/kubernetes/issues/43459

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party Advisory

Timeline

No history available yet.