CVE-2018-2475

HIGH Year: 2018
CVSS v3 Score
8.5
High
CVSS v2 Score
6.0
Medium
Weakness Type
NVD-CWE-Other
View all →

Vulnerability Description

Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot cluster resides in the corresponding seed cluster. Due to missing network isolation a shoot's apiserver can access services/endpoints in the private network of its corresponding seed cluster. Combined with other minor Kubernetes security issues, the missing network isolation theoretically can lead to compromise other shoot or seed clusters in the "Gardener" context. The issue is rated high due to the high impact of a potential exploitation in "Gardener" context. This was fixed in Gardener release 0.12.4.

Related Vulnerabilities

CVE-2015-6019

HIGH
CVSS:8.5(High)

The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows remote attackers to bypass intended access restrictions by ...

NVD-CWE-Other2015

CVE-2017-10065

HIGH
CVSS:8.5(High)

Vulnerability in the Oracle Retail Point-of-Service component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.2, 13.3, 13.4, 14.0 and 14.1. Easily e...

NVD-CWE-Other2017

CVE-2017-3493

HIGH
CVSS:8.5(High)

Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications (subcomponent: Infrastructure). Supported versions that are affecte...

NVD-CWE-Other2017

CVE-2017-3523

HIGH
CVSS:8.5(High)

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.40 and earlier. Difficult to exploit vulnerability allows low ...

NVD-CWE-Other2017

CVE-2017-3558

HIGH
CVSS:8.5(High)

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily "exploitable" vu...

NVD-CWE-Other2017

CVE-2018-1701

HIGH
CVSS:8.5(High)

IBM InfoSphere Information Server 11.7 could allow an authenciated user under specialized conditions to inject commands into the installation process that would execute on the WebSphere Application Se...

NVD-CWE-Other2018