Vulnerabilities > CVE-2023-29018 - Unspecified vulnerability in Linuxfoundation Openfeature

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

linuxfoundation

NVD

Published: 2023-04-14

Updated: 2023-04-25

Summary

The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows for arbitrary code execution, an attacker could leverage the lax permissions configured on `open-feature-operator-controller-manager` to escalate the privileges of any SA in the cluster. The increased privileges could be used to modify cluster state, leading to DoS, or read sensitive data, including secrets. Version 0.2.32 mitigates this issue by restricting the resources the `open-feature-operator-controller-manager` can modify.

Vulnerable Configurations

Part	Description	Count
Application	Linuxfoundation Linuxfoundation Openfeature - Linuxfoundation Openfeature 0.0.1 Linuxfoundation Openfeature 0.0.2 Linuxfoundation Openfeature 0.0.3 Linuxfoundation Openfeature 0.0.4 Linuxfoundation Openfeature 0.0.5 Linuxfoundation Openfeature 0.0.6 Linuxfoundation Openfeature 0.0.7 Linuxfoundation Openfeature 0.0.8 Linuxfoundation Openfeature 0.0.9 Linuxfoundation Openfeature 0.1.0 Linuxfoundation Openfeature 0.1.1 Linuxfoundation Openfeature 0.2.0 Linuxfoundation Openfeature 0.2.1 Linuxfoundation Openfeature 0.2.2 Linuxfoundation Openfeature 0.2.3 Linuxfoundation Openfeature 0.2.4 Linuxfoundation Openfeature 0.2.5 Linuxfoundation Openfeature 0.2.6 Linuxfoundation Openfeature 0.2.7 Linuxfoundation Openfeature 0.2.8 Linuxfoundation Openfeature 0.2.9 Linuxfoundation Openfeature 0.2.10 Linuxfoundation Openfeature 0.2.11 Linuxfoundation Openfeature 0.2.12 Linuxfoundation Openfeature 0.2.13 Linuxfoundation Openfeature 0.2.14 Linuxfoundation Openfeature 0.2.15 Linuxfoundation Openfeature 0.2.16 Linuxfoundation Openfeature 0.2.17 Linuxfoundation Openfeature 0.2.18 Linuxfoundation Openfeature 0.2.19 Linuxfoundation Openfeature 0.2.20 Linuxfoundation Openfeature 0.2.21 Linuxfoundation Openfeature 0.2.22 Linuxfoundation Openfeature 0.2.23 Linuxfoundation Openfeature 0.2.24 Linuxfoundation Openfeature 0.2.25 Linuxfoundation Openfeature 0.2.26 Linuxfoundation Openfeature 0.2.27 Linuxfoundation Openfeature 0.2.28 Linuxfoundation Openfeature 0.2.29 Linuxfoundation Openfeature 0.2.30 Linuxfoundation Openfeature 0.2.31	44

Summary

Vulnerable Configurations

References