GHSA-74j8-w7f9-pp62CriticalCVSS 9.9

Improper configuration of RBAC permissions obtaining cluster control permissions

Published
June 30, 2023
Last Modified
November 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-33190 →

📋 Description

Summary

Improper configuration of RBAC permissions resulted in obtaining cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster.

Details

detail's is disable by publish.

PoC

detail's is disable by publish.

Impact

  • sealos public cloud user
  • CWE-287 Improper Authentication

🎯 Affected products1

  • go/github.com/labring/sealos:< 4.2.1-rc4

🔗 References (4)