CVE-2020-1742: nmstate kubernetes-nmstate Incorrect Privilege Assignment
Vulnerability summary
CVE-2020-1742 is a high (CVSS 7.0) Incorrect Privilege Assignment vulnerability in nmstate kubernetes-nmstate. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17.2% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 07-06-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. Versions before kubernetes-nmstate-handler-container-v2.3.0-30 are affected.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · GoEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.26% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Github.com/nmstate1 product
- kubernetes-nmstateAll versions (No fix recorded)
Nmstate1 product
- kubernetes-nmstate< 2.3.0
Redhat1 product
3 vendors · 3 products
References
2 links- bugzilla.redhat.com/show_bug.cgi?id=1803608X Refsource MISCWEBExploitIssue TrackingThird Party Advisory
