← Back

CVE-2023-5528

nvd nist
Published: Nov 14, 2023Modified: Jun 17, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.

Affected (7)

Kubernetes
1 product
Kubernetes
Fedoraproject
1 product
Fedora
Configuration A
4 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Kubernetes
Kubernetes
From 1.26.0 to 1.26.11
Kubernetes
From 1.27.0 to 1.27.8
Kubernetes
From 1.28.0 to 1.28.4
Kubernetes
From 1.8.0 to 1.25.16
Running on/withPlatform Versions
Microsoft
Windows
All versions
Configuration B
3 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Fedora
Version 37
Fedora
Version 38
Fedora
Version 39

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (8)

Source: jordan@liggitt.net
Issue TrackingPatch
Source: jordan@liggitt.net
Mailing List
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatch
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
Source: af854a3a-2127-422b-91ae-364da2661108
PatchRelease Notes
Source: af854a3a-2127-422b-91ae-364da2661108
PatchRelease Notes
Source: af854a3a-2127-422b-91ae-364da2661108
PatchRelease Notes
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.