Vulnerability-Lookup

CVE-2023-30851 (GCVE-0-2023-30851)

Vulnerability from cvelistv5 – Published: 2023-05-25 17:47 – Updated: 2025-01-16 19:15

Title

Potential HTTP policy bypass when using header rules in Cilium

Summary

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.

Severity

2.6 (Low)


                        
                          CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-01-16 19:15 UTC

CWE

CWE-693 - Protection Mechanism Failure

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7634 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/cilium/cilium/security/advisor…	x_refsource_CONFIRM
https://github.com/cilium/cilium/releases/tag/v1.11.16	x_refsource_MISC
https://github.com/cilium/cilium/releases/tag/v1.12.9	x_refsource_MISC
https://github.com/cilium/cilium/releases/tag/v1.13.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
cilium	cilium	Affected: < 1.11.16 Affected: >= 1.12.0, < 1.12.9 Affected: >= 1.13.0, < 1.13.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:37:15.467Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4"
          },
          {
            "name": "https://github.com/cilium/cilium/releases/tag/v1.11.16",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/cilium/cilium/releases/tag/v1.11.16"
          },
          {
            "name": "https://github.com/cilium/cilium/releases/tag/v1.12.9",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/cilium/cilium/releases/tag/v1.12.9"
          },
          {
            "name": "https://github.com/cilium/cilium/releases/tag/v1.13.2",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/cilium/cilium/releases/tag/v1.13.2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-30851",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-16T19:15:03.306440Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-16T19:15:24.959Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cilium",
          "vendor": "cilium",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.11.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.12.0, \u003c 1.12.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.13.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-25T17:47:51.095Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4"
        },
        {
          "name": "https://github.com/cilium/cilium/releases/tag/v1.11.16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cilium/cilium/releases/tag/v1.11.16"
        },
        {
          "name": "https://github.com/cilium/cilium/releases/tag/v1.12.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cilium/cilium/releases/tag/v1.12.9"
        },
        {
          "name": "https://github.com/cilium/cilium/releases/tag/v1.13.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cilium/cilium/releases/tag/v1.13.2"
        }
      ],
      "source": {
        "advisory": "GHSA-2h44-x2wx-49f4",
        "discovery": "UNKNOWN"
      },
      "title": "Potential HTTP policy bypass when using header rules in Cilium"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-30851",
    "datePublished": "2023-05-25T17:47:51.095Z",
    "dateReserved": "2023-04-18T16:13:15.881Z",
    "dateUpdated": "2025-01-16T19:15:24.959Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-30851",
      "date": "2026-10-21",
      "epss": "0.00655",
      "percentile": "0.50703"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "cilium",
                "vendor": "cilium",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.11.16"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.12.0, \u003c 1.12.9"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.13.0, \u003c 1.13.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "826FEF2C-9172-44D8-AE4C-B656329510F2",
                    "versionEndExcluding": "1.11.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A8371AD7-2C69-4584-B0C3-2AB4E632FC37",
                    "versionEndExcluding": "1.12.9",
                    "versionStartIncluding": "1.12.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B2A8D7A6-200B-443C-B171-512964293B8D",
                    "versionEndExcluding": "1.13.2",
                    "versionStartIncluding": "1.13.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2."
          }
        ],
        "id": "CVE-2023-30851",
        "lastModified": "2026-06-17T05:55:46.380",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 2.6,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-30851",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-16T19:15:03.306440Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-05-25T18:15:10.240",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/cilium/cilium/releases/tag/v1.11.16"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/cilium/cilium/releases/tag/v1.12.9"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/cilium/cilium/releases/tag/v1.13.2"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/cilium/cilium/releases/tag/v1.11.16"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/cilium/cilium/releases/tag/v1.12.9"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/cilium/cilium/releases/tag/v1.13.2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-693"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T22:54:46+00:00",
      "cve": "CVE-2023-30851",
      "id": "CVE-2023-30851",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Potential HTTP policy bypass when using header rules in Cilium",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-30851.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T14:37:15.467Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4",
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4"
              },
              {
                "name": "https://github.com/cilium/cilium/releases/tag/v1.11.16",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/cilium/cilium/releases/tag/v1.11.16"
              },
              {
                "name": "https://github.com/cilium/cilium/releases/tag/v1.12.9",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/cilium/cilium/releases/tag/v1.12.9"
              },
              {
                "name": "https://github.com/cilium/cilium/releases/tag/v1.13.2",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/cilium/cilium/releases/tag/v1.13.2"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-30851",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-01-16T19:15:03.306440Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-01-16T19:15:16.929Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "cilium",
              "vendor": "cilium",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.11.16"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.12.0, \u003c 1.12.9"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.13.0, \u003c 1.13.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 2.6,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-693",
                  "description": "CWE-693: Protection Mechanism Failure",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-05-25T17:47:51.095Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4"
            },
            {
              "name": "https://github.com/cilium/cilium/releases/tag/v1.11.16",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/cilium/cilium/releases/tag/v1.11.16"
            },
            {
              "name": "https://github.com/cilium/cilium/releases/tag/v1.12.9",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/cilium/cilium/releases/tag/v1.12.9"
            },
            {
              "name": "https://github.com/cilium/cilium/releases/tag/v1.13.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/cilium/cilium/releases/tag/v1.13.2"
            }
          ],
          "source": {
            "advisory": "GHSA-2h44-x2wx-49f4",
            "discovery": "UNKNOWN"
          },
          "title": "Potential HTTP policy bypass when using header rules in Cilium"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2023-30851",
        "datePublished": "2023-05-25T17:47:51.095Z",
        "dateReserved": "2023-04-18T16:13:15.881Z",
        "dateUpdated": "2025-01-16T19:15:24.959Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

bit-cilium-2023-30851

Vulnerability from bitnami_vulndb

Published

2024-05-15 12:07

Modified

2026-09-08 08:34

Summary

Potential HTTP policy bypass when using header rules in Cilium

Details

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple toEndpoints AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "cilium",
        "purl": "pkg:bitnami/cilium"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.11.16"
            },
            {
              "introduced": "1.12.0"
            },
            {
              "fixed": "1.12.9"
            },
            {
              "introduced": "1.13.0"
            },
            {
              "fixed": "1.13.2"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-30851"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
  },
  "details": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.",
  "id": "BIT-cilium-2023-30851",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2024-05-15T12:07:32.074Z",
  "references": [
    {
      "type": "ARTICLE",
      "url": "https://github.com/cilium/cilium/releases/tag/v1.11.16"
    },
    {
      "type": "ARTICLE",
      "url": "https://github.com/cilium/cilium/releases/tag/v1.12.9"
    },
    {
      "type": "ARTICLE",
      "url": "https://github.com/cilium/cilium/releases/tag/v1.13.2"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30851"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "Potential HTTP policy bypass when using header rules in Cilium"
}

FKIE_CVE-2023-30851

Vulnerability from fkie_nvd - Published: 2023-05-25 18:15 - Updated: 2026-06-17 05:55

Severity

2.6 (Low) - CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/cilium/cilium/releases/tag/v1.11.16	Release Notes
security-advisories@github.com	https://github.com/cilium/cilium/releases/tag/v1.12.9	Release Notes
security-advisories@github.com	https://github.com/cilium/cilium/releases/tag/v1.13.2	Release Notes
security-advisories@github.com	https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/cilium/cilium/releases/tag/v1.11.16	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/cilium/cilium/releases/tag/v1.12.9	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/cilium/cilium/releases/tag/v1.13.2	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4	Vendor Advisory

Impacted products

Vendor	Product	Version
cilium	cilium	*
cilium	cilium	*
cilium	cilium	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "cilium",
          "vendor": "cilium",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.11.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.12.0, \u003c 1.12.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.13.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "826FEF2C-9172-44D8-AE4C-B656329510F2",
              "versionEndExcluding": "1.11.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8371AD7-2C69-4584-B0C3-2AB4E632FC37",
              "versionEndExcluding": "1.12.9",
              "versionStartIncluding": "1.12.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2A8D7A6-200B-443C-B171-512964293B8D",
              "versionEndExcluding": "1.13.2",
              "versionStartIncluding": "1.13.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2."
    }
  ],
  "id": "CVE-2023-30851",
  "lastModified": "2026-06-17T05:55:46.380",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 2.6,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-30851",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-01-16T19:15:03.306440Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-05-25T18:15:10.240",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/cilium/cilium/releases/tag/v1.11.16"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/cilium/cilium/releases/tag/v1.12.9"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/cilium/cilium/releases/tag/v1.13.2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/cilium/cilium/releases/tag/v1.11.16"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/cilium/cilium/releases/tag/v1.12.9"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/cilium/cilium/releases/tag/v1.13.2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-693"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-2H44-X2WX-49F4

Vulnerability from github – Published: 2023-05-22 20:33 – Updated: 2023-06-02 23:57

Summary

Potential HTTP policy bypass when using header rules in Cilium

Details

Impact

This issue only impacts users who:

Have a HTTP policy that applies to multiple toEndpoints AND
Have an allow-all rule in place that affects only one of those endpoints

In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies.

Patches

This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.

Workarounds

Rewrite HTTP rules for each endpoint separately. For example, if the initial rule looks like:

  egress:
    - toEndpoints:
        - matchLabels:
            k8s:kind: echo
        - matchLabels:
            k8s:kind: example
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: "GET"

It should be rewritten to:

  egress:
    - toEndpoints:
        - matchLabels:
            k8s:kind: echo
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: "GET"
    - toEndpoints:
        - matchLabels:
            k8s:kind: example
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: "GET"

Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @jrajahalme for investigating and fixing the issue.

For more information

If you have any questions or comments about this advisory, please reach out on Slack.

As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: security@cilium.io - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cilium/cilium"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.11.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cilium/cilium"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.12.0"
            },
            {
              "fixed": "1.12.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cilium/cilium"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.13.0"
            },
            {
              "fixed": "1.13.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-30851"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-693"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-22T20:33:15Z",
    "nvd_published_at": "2023-05-25T18:15:10Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nThis issue only impacts users who:\n\n- Have a HTTP policy that applies to multiple `toEndpoints` AND\n- Have an allow-all rule in place that affects only one of those endpoints\n\nIn such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies.\n\n### Patches\n\nThis issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.\n\n### Workarounds\n\nRewrite HTTP rules for each endpoint separately. For example, if the initial rule looks like:\n\n```\n  egress:\n    - toEndpoints:\n        - matchLabels:\n            k8s:kind: echo\n        - matchLabels:\n            k8s:kind: example\n      toPorts:\n        - ports:\n            - port: \"8080\"\n              protocol: TCP\n          rules:\n            http:\n              - method: \"GET\"\n```\n\nIt should be rewritten to:\n \n```\n  egress:\n    - toEndpoints:\n        - matchLabels:\n            k8s:kind: echo\n      toPorts:\n        - ports:\n            - port: \"8080\"\n              protocol: TCP\n          rules:\n            http:\n              - method: \"GET\"\n    - toEndpoints:\n        - matchLabels:\n            k8s:kind: example\n      toPorts:\n        - ports:\n            - port: \"8080\"\n              protocol: TCP\n          rules:\n            http:\n              - method: \"GET\"\n```     \n\n### Acknowledgements\n\nThe Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @jrajahalme for investigating and fixing the issue.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).\n\nAs usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: [security@cilium.io](mailto:security@cilium.io) - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.\n",
  "id": "GHSA-2h44-x2wx-49f4",
  "modified": "2023-06-02T23:57:03Z",
  "published": "2023-05-22T20:33:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30851"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cilium/cilium"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cilium/cilium/releases/tag/v1.11.16"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cilium/cilium/releases/tag/v1.12.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cilium/cilium/releases/tag/v1.13.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Potential HTTP policy bypass when using header rules in Cilium"
}

GSD-2023-30851

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-30851

Aliases

CVE-2023-30851

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-30851",
    "id": "GSD-2023-30851"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-30851"
      ],
      "details": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.",
      "id": "GSD-2023-30851",
      "modified": "2023-12-13T01:20:52.186496Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2023-30851",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "cilium",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003c 1.11.16"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 1.12.0, \u003c 1.12.9"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 1.13.0, \u003c 1.13.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "cilium"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-693",
                "lang": "eng",
                "value": "CWE-693: Protection Mechanism Failure"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4",
            "refsource": "MISC",
            "url": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4"
          },
          {
            "name": "https://github.com/cilium/cilium/releases/tag/v1.11.16",
            "refsource": "MISC",
            "url": "https://github.com/cilium/cilium/releases/tag/v1.11.16"
          },
          {
            "name": "https://github.com/cilium/cilium/releases/tag/v1.12.9",
            "refsource": "MISC",
            "url": "https://github.com/cilium/cilium/releases/tag/v1.12.9"
          },
          {
            "name": "https://github.com/cilium/cilium/releases/tag/v1.13.2",
            "refsource": "MISC",
            "url": "https://github.com/cilium/cilium/releases/tag/v1.13.2"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-2h44-x2wx-49f4",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c1.11.16||\u003e=1.12.0 \u003c1.12.9||\u003e=1.13.0 \u003c1.13.2",
          "affected_versions": "All versions before 1.11.16, all versions starting from 1.12.0 before 1.12.9, all versions starting from 1.13.0 before 1.13.2",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2023-05-22",
          "description": "### Impact\n\nThis issue only impacts users who:\n\n- Have a HTTP policy that applies to multiple `toEndpoints` AND\n- Have an allow-all rule in place that affects only one of those endpoints\n\nIn such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies.",
          "fixed_versions": [
            "1.11.16",
            "1.12.9",
            "1.13.2"
          ],
          "identifier": "CVE-2023-30851",
          "identifiers": [
            "GHSA-2h44-x2wx-49f4",
            "CVE-2023-30851"
          ],
          "not_impacted": "All versions starting from 1.11.16 before 1.12.0, all versions starting from 1.12.9 before 1.13.0, all versions starting from 1.13.2",
          "package_slug": "go/github.com/cilium/cilium",
          "pubdate": "2023-05-22",
          "solution": "Upgrade to versions 1.11.16, 1.12.9, 1.13.2 or above.",
          "title": "Potential HTTP policy bypass when using header rules in Cilium",
          "urls": [
            "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4",
            "https://github.com/cilium/cilium/releases/tag/v1.11.16",
            "https://github.com/cilium/cilium/releases/tag/v1.12.9",
            "https://github.com/cilium/cilium/releases/tag/v1.13.2",
            "https://github.com/advisories/GHSA-2h44-x2wx-49f4"
          ],
          "uuid": "4952d141-aafd-4b02-b663-cdc996f5f83c"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.13.2",
                "versionStartIncluding": "1.13.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.12.9",
                "versionStartIncluding": "1.12.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.11.16",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2023-30851"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP policy that applies to multiple `toEndpoints` AND have an allow-all rule in place that affects only one of those endpoints. In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies. This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/cilium/cilium/releases/tag/v1.13.2",
              "refsource": "MISC",
              "tags": [
                "Release Notes"
              ],
              "url": "https://github.com/cilium/cilium/releases/tag/v1.13.2"
            },
            {
              "name": "https://github.com/cilium/cilium/releases/tag/v1.11.16",
              "refsource": "MISC",
              "tags": [
                "Release Notes"
              ],
              "url": "https://github.com/cilium/cilium/releases/tag/v1.11.16"
            },
            {
              "name": "https://github.com/cilium/cilium/releases/tag/v1.12.9",
              "refsource": "MISC",
              "tags": [
                "Release Notes"
              ],
              "url": "https://github.com/cilium/cilium/releases/tag/v1.12.9"
            },
            {
              "name": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://github.com/cilium/cilium/security/advisories/GHSA-2h44-x2wx-49f4"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.6,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-06-01T20:35Z",
      "publishedDate": "2023-05-25T18:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-30851 (GCVE-0-2023-30851)

bit-cilium-2023-30851

Vulnerability from bitnami_vulndb

FKIE_CVE-2023-30851

GHSA-2H44-X2WX-49F4

Impact

Patches

Workarounds

Acknowledgements

For more information

GSD-2023-30851

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour