Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2019-11248
Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Kubernetes kubelet exposes /debug/pprof info on healthz port
Source: NVD (National Vulnerability Database)
Vulnerability Description
The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
未保护的主要通道
Source: NVD (National Vulnerability Database)
Vulnerability Title
Google Kubernetes 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Google Kubernetes是美国谷歌(Google)公司的一套开源的Docker容器集群管理系统。该系统为容器化的应用提供资源调度、部署运行、服务发现和扩容缩容等功能。 Google Kubernetes中存在信息泄露漏洞。该漏洞源于网络系统或产品在运行过程中存在配置等错误。未授权的攻击者可利用漏洞获取受影响组件敏感信息。以下产品及版本受到影响:Google Kubernetes 1.15.0之前版本,1.14.4之前版本,1.13.8之前版本,1.12.10之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
VendorProductAffected VersionsCPESubscribe
KubernetesKubernetes prior to 1.12.10 -
II. Public POCs for CVE-2019-11248
#POC DescriptionSource LinkShenlong Link
1POC for CVE-2019-11248, remote code execution (RCE)https://github.com/nop2nop/cve-2019-11248POC Details
2POC for CVE-2019-11248, remote code execution (RCE)https://github.com/masm3264/poc-CVE-2019-11248POC Details
3Nonehttps://github.com/nod3jzzz/poc-CVE-2019-11248POC Details
4Nonehttps://github.com/g1thubb001/poc-CVE-2019-11248POC Details
5cve-2019-11248 cve-2020-1938https://github.com/bash3rt3am/poc-cvePOC Details
6The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11248.yamlPOC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC
III. Intelligence Information for CVE-2019-11248
Please Login to view more intelligence information
IV. Related Vulnerabilities
V. Comments for CVE-2019-11248

No comments yet


Leave a comment