CVE-2020-2023

MEDIUM Year: 2020
CVSS v3 Score
6.3
Medium
CVSS v2 Score
4.6
Medium
Weakness Type
CWE-250
View all →

Vulnerability Description

Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.

Related Vulnerabilities

CVE-2018-10892

MEDIUM
CVSS:6.3(Medium)

The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disab...

CWE-2502018

CVE-2019-10143

MEDIUM
CVSS:6.4(Medium)

It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges...

CWE-2502019

CVE-2024-51722

MEDIUM
CVSS:6.4(Medium)

A local privilege escalation vulnerability in the SecuSUITE Server (System Configuration) of SecuSUITE versions 5.0.420 and earlier could allow a successful attacker that had gained control of code ru...

CWE-2502024

CVE-2023-30617

MEDIUM
CVSS:6.5(Medium)

Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1, and 1.5.2, an attacker who has gained root privilege of th...

CWE-2502023

CVE-2023-42954

MEDIUM
CVSS:6.5(Medium)

A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to the Admin Console with an administrator role. This issue ha...

CWE-2502023

CVE-2024-20478

MEDIUM
CVSS:6.5(Medium)

A vulnerability in the software upgrade component of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an authen...

CWE-2502024