CVE-2020-15187

Aliases:GHSA-c52f-pq47-2r9jBIT-helm-2020-15187
Advisory lineage Upstream: 0 Downstream: 1
Modified
Published: 17 Sept 2020, 21:50
Last modified:29 May 2025, 22:59

Vulnerability Summary

Overall Risk (default)
medium
26/100
CVSS Score
6.5 MEDIUM
v2.0 (nvd)
EPSS Score
0.19% LOW
0% probability +0.05%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

17 Sept 2020, 21:50
Published
Vulnerability first disclosed
29 May 2025, 22:59
Last Modified
Vulnerability information updated

Description

In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack. To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 2.16.11 and Helm 3.3.2. As a possible workaround make sure to install plugins using a secure connection protocol like SSL.

CVSS Metrics

  • v3.1•LOW•Score: 3CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
  • v3.1•MEDIUM•Score: 4.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
  • v2.0•MEDIUM•Score: 6.5AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 0.19%• Percentile: 41%

Techniques & Countermeasures

  • CWE-694•Use of Multiple Resources with Duplicate Identifier

    The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

  • CWE-74•Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

    The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Systems

  • helm.sh•helm

    ≥ 2.0.0, < 2.16.11

  • helm.sh/helm•v3

    ≥ 3.0.0, < 3.3.2

  • helm•helm

    ≥ 2.0.0, < 2.16.11 | ≥ 3.0.0, < 3.3.2

References (9)