CVE-2019-11243: kubernetes Privilege Dropping / Lowering Errors
Vulnerability summary
CVE-2019-11243 is a high (CVSS 8.1) Privilege Dropping / Lowering Errors vulnerability in kubernetes. EPSS estimates a 1.49% chance of exploitation in the next 30 days, higher than 73.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 22-04-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · GoEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST3.1LowCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
1.49%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
0.00 pp
From 1.49% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-271Privilege Dropping / Lowering ErrorsThe product does not drop privileges before passing control of a resource to an actor that does not have those privileges.
- CWE-212Improper Removal of Sensitive Information Before Storage or TransferThe product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Affected systems
K8s.io1 product
- kubernetes≥ 1.12.0, < 1.12.5 | ≥ 1.13.0, < 1.13.1
Kubernetes1 product
- kubernetes≥ v1.12, ≤ v1.12.4 | ≥ v1.13, ≤ v1.13.0 | ≥ 1.12.0, ≤ 1.12.4 | 1.13.0
Netapp1 product
- tridentna
3 vendors · 3 products
