Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to gain access to the IAAS account.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCloudfoundry Container Runtime
APPCloudfoundry< 0.28.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
LPEContainer
Related vulnerabilities
CVE-2019-3779HIGH8.8same product
Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA (Ce...
CVE-2022-31733CRITICAL9.1PL ✓same vendor
Cloudfoundry Diego — pominięcie uwierzytelniania mTLS przez niezabezpieczony port
CVE-2018-25046CRITICAL9.1PL ✓same vendor
Path traversal w Cloudfoundry Archiver umożliwia zapis plików poza katalogiem docelowym
CVE-2019-3801CRITICAL9.8PL ✓same vendor
Cloud Foundry cf-deployment: wstrzyknięcie kodu przez niezaszyfrowany protokół pobierania zależności
CVE-2016-6658CRITICAL9.6PL ✓same vendor
Ujawnienie danych uwierzytelniających buildpack w Cloud Foundry CF-Release