CVE-2022-45933: Improper Authentication

November 27, 2022 (updated August 8, 2023)

KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieves certificate files that can be used for authentication as kube-admin. NOTE: the vendor’s position is that KubeView was a “fun side project and a learning exercise,” and not “very secure.”

References

github.com/benc-uk/kubeview/issues/95
nvd.nist.gov/vuln/detail/CVE-2022-45933

Code Behaviors & Features

Detect and mitigate CVE-2022-45933 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →