CVE-2023-22480

HIGHNuclei

KubeOperator is vulnerable to unauthorized access to system API

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-22480 has a selected CVSS score of 7.3 (high); EIP currently links 1 Nuclei template.

Description

KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 10, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

KubeOperator

Browse KubeOperator / KubeOperator
CVE List<= 3.16.3affected

github.com/KubeOperator/KubeOperator

Browse Go / github.com/KubeOperator/KubeOperator
GitHub AdvisoryThrough 3.16.3affected

Nuclei templates

1
ProjectDiscoveryCRITICALKubeOperator Foreground `kubeconfig` - File DownloadCVSS 9.8

KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to take over the cluster under certain conditions. This issue has been patched in version 3.16.4.

Impact

An attacker can download sensitive files from the KubeOperator Foreground kubeconfig file, potentially leading to unauthorized access or exposure of sensitive information.

Remediation

Upgrade to the latest version to mitigate this vulnerability.

WeaknessesCWE-863CWE-285
AuthorsDhiyaneshDk
Template tagscve2023cvekubeoperatork8skubeconfigexposurefit2cloudvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:fit2cloud:kubeoperator:*:*:*:*:*:*:*:*
Shodan: html:"KubeOperator"
Shodan: http.html:"kubeoperator"
FOFA: app="KubeOperator"
FOFA: body="kubeoperator"
FOFA: app="kubeoperator"
https://github.com/KubeOperator/KubeOperator/security/advisories/GHSA-jxgp-jgh3-8jc8 https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/webapp/KubeOperator/KubeOperator%20kubeconfig%20%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E6%BC%8F%E6%B4%9E%20CVE-2023-22480.md?plain=1 https://nvd.nist.gov/vuln/detail/CVE-2023-22480 https://github.com/KubeOperator/KubeOperator/commit/7ef42bf1c16900d13e6376f8be5ecdbfdfb44aaf https://github.com/KubeOperator/KubeOperator/releases/tag/v3.16.4

Source: ProjectDiscovery

References

5