← Back

CVE-2020-8555

nvd nist
Published: Jun 5, 2020Modified: Jun 17, 2026

JSON object

Loading...
6.3
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Exploitability: 1.8 / Impact: 4.0
Source: NVD

Description

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).

Affected (5)

Kubernetes
1 product
Kubernetes
Fedoraproject
1 product
Fedora
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Kubernetes
Kubernetes
Before 1.15.11
Kubernetes
From 1.16.0 to 1.16.9
Kubernetes
From 1.17.0 to 1.17.5
Kubernetes
Version 1.18.0
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Fedora
Version 32

Related CWEs

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (12)

Source: jordan@liggitt.net
Mailing ListThird Party Advisory
Source: jordan@liggitt.net
Mailing ListThird Party Advisory
Source: jordan@liggitt.net
Third Party Advisory
Source: jordan@liggitt.net
Mailing ListThird Party Advisory
Source: jordan@liggitt.net
Source: jordan@liggitt.net
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.