Description
Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mirantis | bored-agent | 0.6 – < 0.6.1 | 0.6.1 |
High · 8.8
CVE-2022-0270
EUVD-2022-15449GHSA-r5c2-7hp9-v678
Improper header sanitization in bored-agent causes escalation of privilege
Published Jan 25, 2022 · Updated Sep 16, 2024 · Assigned by Mirantis