CVE-2015-5305

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-5305
Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.

6.4 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://access.redhat.com/errata/RHSA-2015:1945 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1273969 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:openshift:3.0:*:*:*:enterprise:*:*:*
History

13 Feb 2023, 00:53

Type Values Removed Values Added
Summary Kubernetes fails to validate object name types before passing the data to etcd. As the etcd service generates keys based on the object name type this can lead to a directory path traversal. Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2015-5305', 'name': 'https://access.redhat.com/security/cve/CVE-2015-5305', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 21:15

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2015-5305 -
Summary Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd. Kubernetes fails to validate object name types before passing the data to etcd. As the etcd service generates keys based on the object name type this can lead to a directory path traversal.
Information

Published : 2015-11-06 18:59

Updated : 2023-12-10 11:46

NVD link : CVE-2015-5305

Mitre link : CVE-2015-5305

CVE.ORG link : CVE-2015-5305

JSON object : View

Products Affected

redhat

  • openshift
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')