CVE-2023-22480
Published: 14 January 2023
Summary
CVE-2023-22480 is a high-severity Improper Authorization (CWE-285) vulnerability in Fit2Cloud Kubeoperator. Its CVSS base score is 7.3 (High).
Operationally, ranked in the top 1.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
KubeOperator versions 3.16.3 and earlier contain an authorization flaw (CWE-285/CWE-863) in which multiple API endpoints accept requests from unauthenticated callers. The affected component is the web API layer of this open-source Kubernetes distribution used for planning, deploying, and operating production clusters. The issue permits leakage of sensitive cluster configuration and credential material, rated 7.3 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
An unauthenticated network attacker can invoke the exposed endpoints to retrieve internal data and, under certain deployment conditions, escalate the access to full cluster takeover. No user interaction or prior credentials are required, making the attack remotely exploitable against any reachable KubeOperator instance running an unpatched release.
The project has released version 3.16.4 containing the fix; the corresponding commits and advisory are published in the KubeOperator GitHub repository (GHSA-jxgp-jgh3-8jc8). Administrators are advised to upgrade immediately and verify that the updated API authorization checks are active.
EPSS values have remained elevated, with a recorded peak of 0.7924 and a current score of 0.7559, indicating sustained exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-0499
Vulnerability details
KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used to…
more
take over the cluster under certain conditions. This issue has been patched in version 3.16.4.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Documented procedures facilitate correct implementation and ongoing management of authorization decisions.
Periodic reviews identify and correct flaws in authorization decisions or enforcement.
Establishing permitted attributes and values, plus auditing changes, ensures authorization decisions are based on correctly managed policy data.
Explicitly mandates authorizing remote access types before permitting connections, directly mitigating improper authorization.
The control explicitly requires authorization of each wireless access type prior to permitting connections.
Mandating explicit authorization of mobile device connections reduces the risk of improper authorization decisions for system access.
Specifying access authorizations for each account and requiring approvals for account requests enforces proper authorization decisions.
Requires explicit authorization for individuals to use external systems to access or handle organization-controlled information.