CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2024-5321 – Incorrect permissions on Windows containers logs
https://notcve.org/view.php?id=CVE-2024-5321
A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs. Se descubrió un problema de seguridad en clústeres de Kubernetes con nodos de Windows donde BUILTIN\Users pueden leer registros de contenedores y NT AUTHORITY\Authenticated Users pueden modificar registros de contenedores. A flaw was found in Kubernetes clusters with Windows nodes. BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs. • https://github.com/kubernetes/kubernetes/issues/126161 https://groups.google.com/g/kubernetes-security-announce/c/81c0BHkKNt0 https://access.redhat.com/security/cve/CVE-2024-5321 https://bugzilla.redhat.com/show_bug.cgi?id=2298752 • CWE-276: Incorrect Default Permissions •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-30513
https://notcve.org/view.php?id=CVE-2023-30513
Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled. • http://www.openwall.com/lists/oss-security/2023/04/13/3 https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-3075 • CWE-319: Cleartext Transmission of Sensitive Information •