CVE-2021-3948 Misconfiguration in mig-controller
An attacker can migrate malicious workloads to a target cluster due to incorrect default permissions, compromising confidentiality, integrity, and availability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-3948?
CVE-2021-3948 is a medium-severity vulnerability in mig-controller, published on 18 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An incorrect default permissions vulnerability was found in the mig-controller. Due to an incorrect cluster namespaces handling an attacker may be able to migrate a malicious workload to the target cluster, impacting confidentiality, integrity, and availability of the services located on that cluster.
Weakness: CWE-276
Which versions are affected by CVE-2021-3948?
It affects 2 products.
Products include Konveyor Mig-Controller, Redhat Migration Toolkit.
How do I fix CVE-2021-3948?
No fix has been published for CVE-2021-3948 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-3948 being exploited?
There is no known exploitation of CVE-2021-3948 in the wild and no public exploit code.
Sources
Also known as GHSA-6g8x-w285-c7m5.