CVE-2023-29332 - Vulnerability Details - OpenCVE

Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Microsoft	Azure Kubernetes Service

Configuration 1 [-]

cpe:2.3:a:microsoft:azure_kubernetes_service:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29332

History

Tue, 04 Mar 2025 03:45:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2023-09-12T16:58:34.444Z

Updated: 2025-02-27T20:54:08.046Z

Reserved: 2023-04-04T22:34:18.379Z

Link: CVE-2023-29332

Vulnrichment

Updated: 2024-08-02T14:07:45.624Z

NVD

Status : Modified

Published: 2023-09-12T17:15:08.790

Modified: 2024-11-21T07:56:52.810

Link: CVE-2023-29332

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-29332", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2023-04-04T22:34:18.379Z", "datePublished": "2023-09-12T16:58:34.444Z", "dateUpdated": "2025-02-27T20:54:08.046Z"}, "containers": {"cna": {"title": "Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability", "datePublic": "2023-09-12T07:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:azure_kubernetes_service:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0", "versionEndExcluding": "VHD 202308"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Azure Kubernetes Service", "platforms": ["Unknown"], "versions": [{"version": "1.0", "lessThan": "VHD 202308", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-330: Use of Insufficiently Random Values", "lang": "en-US", "type": "CWE", "cweId": "CWE-330"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-01-01T02:04:06.064Z"}, "references": [{"name": "Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29332"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:07:45.624Z"}, "title": "CVE Program Container", "references": [{"name": "Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "x_transferred"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29332"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-26T21:50:20.635220Z", "id": "CVE-2023-29332", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-27T20:54:08.046Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-29332", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2023-04-04T22:34:18.379Z", "datePublished": "2023-09-12T16:58:34.444Z", "dateUpdated": "2025-02-27T20:54:08.046Z"}, "containers": {"cna": {"title": "Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability", "datePublic": "2023-09-12T07:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:azure_kubernetes_service:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0", "versionEndExcluding": "VHD 202308"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Azure Kubernetes Service", "platforms": ["Unknown"], "versions": [{"version": "1.0", "lessThan": "VHD 202308", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-330: Use of Insufficiently Random Values", "lang": "en-US", "type": "CWE", "cweId": "CWE-330"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-01-01T02:04:06.064Z"}, "references": [{"name": "Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29332"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:07:45.624Z"}, "title": "CVE Program Container", "references": [{"name": "Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "x_transferred"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29332"}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-29332", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-26T21:50:20.635220Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-26T20:37:13.427Z"}}]}}