9.8

CVE-2023-38495: cncf crossplane Improper Input Validation

CVSS: 9.8v3.1CriticalModified
AliasesCGA-4rvc-fhrj-mx9wCGA-c57w-f4fg-p96mGHSA-pj4x-2xr5-w87m
Published 27-07-2023Last modified 10-10-2024
Open JSON

Vulnerability summary

CVE-2023-38495 is a critical (CVSS 9.8) Improper Input Validation vulnerability in cncf crossplane. EPSS estimates a 0.84% chance of exploitation in the next 30 days, higher than 57.2% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (NVD)
EPSS score
0.84%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-46H3-844V-3JGVCGA-884M-C7C9-59QJ

Timeline

  1. 27-07-2023
    PublishedVulnerability first disclosed.
  2. 10-10-2024
    Last modifiedVulnerability information updated.

Description

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0. As a workaround, only use images from trusted sources and keep Package editing/creating privileges to administrators only.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.84%

Chance of exploitation in the next 30 days

Percentile

57%

Versus all other CVEs

30-day change

0.00 pp

From 0.84% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.84%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Crossplane

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard1 product
  • crossplane-crankAll versions (No fix recorded)
Cncf1 product
Crossplane1 product
Github.com/crossplane1 product
  • crossplane< 1.11.5 | ≥ 1.12.0, < 1.12.3
Wolfi1 product
  • crossplane-crankAll versions (No fix recorded)

5 vendors · 5 products

References

5 links