CVE-2023-38495 - CVE House
Back to Database
Status published High CVE-2023-38495

Crossplane vulnerable to possible image tampering from missing image validation for Packages

Vulnerability Description

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0. As a workaround, only use images from trusted sources and keep Package editing/creating privileges to administrators only.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-38495

Credits & Attribution

No credits recorded in the NVD database.

References

More from crossplane

View All →
CVE-2023-37900
Crossplane vulnerable to denial of service from large image
Low 3.4
CVE-2023-27484
Unchecked fieldpath index in Composition's patches can lead to arbitrary memory allocation in crossplane
Medium 6.2
CVE-2023-27483
fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime
Medium 5.9

Affected Vendor

Affected Software

crossplane
Vulnerable Versions:
< 1.11.5, >= 1.12.0, < 1.12.3

Timeline

Official Publish: July 27th, 2023
Last Modified: October 10th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact