CVE-2023-33190
In versions of Sealos prior to 4.2.1-rc4 an improper configuration of role based access control (RBAC) permissions resulted in an attacker being able to obtain cluster control permissions, which could control the entire cluster deployed with Sealos, as…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.71%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of role based access control (RBAC) permissions resulted in an attacker being able to obtain cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster. This issue has been addressed in version 4.2.1-rc4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.71% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287, CWE-863
- Affected
- sealos project/sealos
- Source
- security-advisories@github.com
References
- https://github.com/labring/sealos/commit/4cdf52e55666864e5f90ed502e9fc13e18985b7bPatch
- https://github.com/labring/sealos/security/advisories/GHSA-74j8-w7f9-pp62Vendor Advisory
- https://github.com/labring/sealos/commit/4cdf52e55666864e5f90ed502e9fc13e18985b7bPatch
- https://github.com/labring/sealos/security/advisories/GHSA-74j8-w7f9-pp62Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.