Medium severity · published Jan 21, 2021
CVE-2020-8567
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted…
6.5
CVSS
1.5%
EPSS
No
On KEV
Description
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AK
Azure Key Vault Provider For Secrets Store Csi Driver · Microsoft
before 0.0.10 · source: NVD
SM
Secret Manager Provider For Secret Store Csi Driver · Google
before 0.2.0 · source: NVD
VP
Vault Provider For Secrets Store Csi Driver · Hashicorp
before 0.0.6 · source: NVD
Affected product
SM
Secret Manager Provider For Secret Store Csi Driver
Google