CVE-2018-2475 Missing authorization in project “Gardener”
Missing network isolation allows a shoot cluster's API server to access private seed cluster services, potentially compromising other clusters.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-2475?
CVE-2018-2475 is a high-severity missing authorization vulnerability in SAP project “Gardener”, published on 9 Oct 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot cluster resides in the corresponding seed cluster. Due to missing network isolation a shoot's apiserver can access services/endpoints in the private network of its corresponding seed cluster. Combined with other minor Kubernetes security issues, the missing network isolation theoretically can lead to compromise other shoot or seed clusters in the "Gardener" context. The issue is rated high due to the high impact of a potential exploitation in "Gardener" context. This was fixed in Gardener release 0.12.4.
Which versions are affected by CVE-2018-2475?
It affects 1 product.
Products include Gardener Gardener.
How do I fix CVE-2018-2475?
No fix has been published for CVE-2018-2475 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-2475 being exploited?
There is no known exploitation of CVE-2018-2475 in the wild and no public exploit code.
Other vulnerabilities in SAP project “Gardener”
Sources
Also known as GHSA-g482-4r7c-68g6.