CVE-2020-8553: kubernetes ingress-nginx External Control of File Name or Path
Vulnerability summary
CVE-2020-8553 is a medium (CVSS 5.9) External Control of File Name or Path vulnerability in kubernetes ingress-nginx. EPSS estimates a 0.89% chance of exploitation in the next 30 days, higher than 58.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 5Timeline
- 29-07-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · GoEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.89%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
0.00 pp
From 0.89% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
- CWE-610Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Affected systems
K8s.io1 product
- ingress-nginx< 0.28.0
Kubernetes1 product
- ingress-nginx≥ unspecified, < 0.28.0 | < 0.28.0
2 vendors · 2 products
