Kubernetes Vulnerabilities and Affected Products
Vulnerabilities associated with devtron.
Products
Clear product- Kubernetes51 vulnerabilities
- ingress-nginx17 vulnerabilities
- kubelet7 vulnerabilities
- Kubernetes ingress-nginx4 vulnerabilities
- Image Builder3 vulnerabilities
- minikube3 vulnerabilities
- image_builder2 vulnerabilities
- kube-apiserver2 vulnerabilities
- Kubernetes Java Client2 vulnerabilities
- Kubernetes Secrets Store CSI Driver2 vulnerabilities
- apiserver1 vulnerability
- argo-cd1 vulnerability
- aws-iam-authenticator1 vulnerability
- azure-file-csi-driver1 vulnerability
- CSI Driver for NFS1 vulnerability
- CSI Snapshotter1 vulnerability
- csi-proxy1 vulnerability
- devtron1 vulnerability
- k8s.gcr.io/defaultbackend1 vulnerability
- kops1 vulnerability
- Kubernetes CSharp Client1 vulnerability
- kubernetes-client/java1 vulnerability
- kubernetes-csi external-provisioner1 vulnerability
- kubernetes-csi external-resizer1 vulnerability
- kubernetes-csi external-snapshotter1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
SQL Injection in CreateUser API in devtrondevtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user). This issue has been addressed in version 0.7.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. CWE-89Nov 7, 2024 | CVSS-v4.0 | EPSS0.748% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |