CVE-2023-2250

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A flaw was found in the Open Cluster Management (OCM) when a user have access to the worker nodes which has the cluster-manager-registration-controller or cluster-manager deployments. A malicious user can take advantage of this and bind the cluster-admin to any service account or using the service account to list all secrets for all kubernetes namespaces, leading into a cluster-level privilege escalation.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-268

Affected software

No affected versions have been published.

Timeline

Published: Apr 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-225007.5GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorizatio CVE-2023-225019.1An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate ano CVE-2023-225035.3Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and label CVE-2023-225046.5Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to u CVE-2023-225058.8This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data Cent CVE-2023-225068.8This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo CVE-2023-225088.8This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Cent CVE-2023-22517.5Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5.CVE-2023-225127.5This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS S CVE-2023-225138.8This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (CVE-2023-225147.8This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and Sourcetree for Windo CVE-2023-225159.8Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknow