1. Home
  2. CVE Database
  3. CVE-2023-3027
HIGH · 7.8

CVE-2023-3027

The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on...

Vulnerability Description

The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on a managed cluster) of taking advantage of cluster scoped access in a created policy. This feature does not restrict properly to lookup content from the namespace where the policy was created.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
RedhatAdvanced Cluster Management For Kubernetes2.5

Related Weaknesses (CWE)

CWE-269CWE-863

References

FAQ

What is CVE-2023-3027?

CVE-2023-3027 is a vulnerability with a CVSS score of 7.8 (HIGH). The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on...

How severe is CVE-2023-3027?

CVE-2023-3027 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-3027?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Advanced Cluster Management For Kubernetes.