CVE-2017-1002100

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to "container" which exposes a URI that can be accessed without authentication on the public internet. Access to the URI string requires privileged access to the Kubernetes cluster or authenticated access to the Azure portal.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Sep 14, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10021019.6In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with CVE-2017-10021025.6In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projec CVE-2017-10021506.1python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection CVE-2017-10021517.5Pagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization CVE-2017-10021526.1Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles.CVE-2017-10021537.5Koji 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.CVE-2017-10021579.8modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution.CVE-2017-100224.3Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Operations). Support CVE-2017-10022016.1In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escape CVE-2017-100236.5Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Operations). Support CVE-2017-100248.2Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: Layout Tools). The supported version that is affected CVE-2017-100258.2Vulnerability in the BI Publisher component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). The supported version that is