60
CVE-2018-1002102
—CVSS 3.1
2.6 low
EPSS
<1%p48
Published
()
Modified
Description
Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.
- Vendors
- kubernetesfedoraproject
- Products
- kubernetes, fedora
- Weakness
- CWE-601
- Vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N