CVE-2021-3586
servicemesh-operator: NetworkPolicy resources incorrectly specify ports for ingress resources
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Se encontró un fallo en servicemesh-operator. Los recursos NetworkPolicy instalados para Maistra no especifican correctamente a qué puertos pueden accederse, permitiendo el acceso a todos los puertos de estos recursos desde cualquier pod. La mayor amenaza de esta vulnerabilidad es la confidencialidad e integridad de los datos, así como la disponibilidad del sistema.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-06-07 CVE Reserved
- 2021-06-11 CVE Published
- 2024-03-14 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-305: Authentication Bypass by Primary Weakness
- CWE-1188: Initialization of a Resource with an Insecure Default
CAPEC
References (2)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2021-3586 | 2021-06-10 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1967738 | 2021-06-10 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Openshift Service Mesh Search vendor "Redhat" for product "Openshift Service Mesh" | 2.0 Search vendor "Redhat" for product "Openshift Service Mesh" and version "2.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Servicemesh-operator Search vendor "Redhat" for product "Servicemesh-operator" | 2.0.5.1 Search vendor "Redhat" for product "Servicemesh-operator" and version "2.0.5.1" | - |
Affected
| ||||||