What is GHSA-jxgp-jgh3-8jc8?

GHSA-jxgp-jgh3-8jc8 is a security advisory published by GitHub Security Advisories with High severity. KubeOperator allows unauthorized access to system API

Which CVE IDs does GHSA-jxgp-jgh3-8jc8 cover?

GHSA-jxgp-jgh3-8jc8 covers the following CVE IDs: CVE-2023-22480. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jxgp-jgh3-8jc8?

GHSA-jxgp-jgh3-8jc8 has a CVSS v3 base score of 7.3, published by GitHub Security Advisories.

Which products are affected by GHSA-jxgp-jgh3-8jc8?

GHSA-jxgp-jgh3-8jc8 affects 1 product, including: go/github.com/KubeOperator/KubeOperator:\u003c= 3.16.3.

GHSA-jxgp-jgh3-8jc8HighCVSS 7.3

KubeOperator allows unauthorized access to system API

Vendor

GitHub Security Advisories

Published

January 9, 2023

Last Modified

February 24, 2023

🔗 CVE IDs covered (1)

CVE-2023-22480 →

📋 Description

Summary

Unauthorized access refers to the ability to bypass the system's preset permission settings to access some API interfaces. The attack exploits a flaw in how online applications handle routing permissions.

Affected Version

<= v3.16.3

Patches

The vulnerability has been fixed in v3.16.3.

https://github.com/KubeOperator/KubeOperator/commit/7ef42bf1c16900d13e6376f8be5ecdbfdfb44aaf

Workarounds

It is recommended to upgrade the version to v3.16.4.

For more information

If you have any questions or comments about this advisory, please open an issue.

References

https://github.com/KubeOperator/KubeOperator/releases/tag/v3.16.4

🎯 Affected products1

go/github.com/KubeOperator/KubeOperator:<= 3.16.3

🔗 References (5)

https://github.com/KubeOperator/KubeOperator/security/advisories/GHSA-jxgp-jgh3-8jc8
https://github.com/KubeOperator/KubeOperator/commit/7ef42bf1c16900d13e6376f8be5ecdbfdfb44aaf
https://github.com/KubeOperator/KubeOperator/releases/tag/v3.16.4
https://nvd.nist.gov/vuln/detail/CVE-2023-22480
https://github.com/advisories/GHSA-jxgp-jgh3-8jc8