CVE-2018-1000400

{"id": "CVE-2018-1000400", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2018-05-18T18:29:00.233", "references": [{"url": "http://www.securityfocus.com/bid/104262", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/kubernetes-incubator/cri-o/pull/1558/files", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via container execution. This vulnerability appears to have been fixed in 1.9."}, {"lang": "es", "value": "Kubernetes CRI-O, en versiones anteriores a la 1.9, contiene una vulnerabilidad de error de switching en un contexto privilegiado (CWE-270) en la gesti\u00f3n de capacidades de ambiente que puede resultar en que los contenedores se ejecuten con privilegios elevados, lo que permite que los usuarios tengan permisos que no deber\u00edan tener. Este ataque parece ser explotable mediante la ejecuci\u00f3n de contenedores. La vulnerabilidad parece haber sido solucionada en la versi\u00f3n 1.9."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kubernetes:cri-o:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70802E01-CBCE-4AB9-BD19-4B2192238DFB", "versionEndExcluding": "1.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}