cve.bz

CVE-2020-8559

6.8 mediumEPSS 6.1%

Medium (6.8) in kubernetes kubernetes. EPSS 6.1% chance of exploitation in the next 30 days. Fixed in k8s.io/apimachinery 0.16.13, 0.17.9, 0.18.7.

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

Severity

CVSS 3.1

6.8 medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
EPSS
6.1% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWE
CWE-601
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-33c5-9fx5-fvjmGok8s.io/apimachinery<0.16.130.16.13
GHSA-33c5-9fx5-fvjmGok8s.io/apimachinery>=0.17.0 <0.17.90.17.9
GHSA-33c5-9fx5-fvjmGok8s.io/apimachinery>=0.18.0 <0.18.70.18.7
GHSA-33c5-9fx5-fvjmGok8s.io/kubernetes<1.16.131.16.13
GHSA-33c5-9fx5-fvjmGok8s.io/kubernetes>=1.17.0 <1.17.91.17.9
GHSA-33c5-9fx5-fvjmGok8s.io/kubernetes>=1.18.0 <1.18.71.18.7
GO-2024-2748Gok8s.io/apimachinery<0.16.13
>=0.17.0 <0.17.9
>=0.18.0 <0.18.7-rc.0		0.16.13, 0.17.9, 0.18.7-rc.0
GO-2024-2748Gok8s.io/kubernetes<1.16.13
>=1.17.0 <1.17.9
>=1.18.0 <1.18.7		1.16.13, 1.17.9, 1.18.7

References

Check your stackJSON