{"api_version":"1","generated_at":"2026-07-23T09:49:07+00:00","cve":"CVE-2019-11247","urls":{"html":"https://cve.report/CVE-2019-11247","api":"https://cve.report/api/cve/CVE-2019-11247.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-11247","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-11247"},"summary":{"title":"CVE-2019-11247","description":"The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.","state":"PUBLIC","assigner":"security@kubernetes.io","published_at":"2019-08-29 01:15:00","updated_at":"2020-10-02 16:21:00"},"problem_types":["CWE-863"],"metrics":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2019:2690","name":"RHSA-2019:2690","refsource":"REDHAT","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHBA-2019:2824","name":"RHBA-2019:2824","refsource":"REDHAT","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/kubernetes/kubernetes/issues/80983","name":"https://github.com/kubernetes/kubernetes/issues/80983","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"CVE-2019-11247: API server allows access to custom resources via wrong scope · Issue #80983 · kubernetes/kubernetes · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.netapp.com/advisory/ntap-20190919-0003/","name":"https://security.netapp.com/advisory/ntap-20190919-0003/","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"September 2019 Kubernetes Vulnerabilities in NetApp Products | NetApp Product Security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHBA-2019:2816","name":"RHBA-2019:2816","refsource":"REDHAT","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal - Access to 24x7 support and knowledge","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://groups.google.com/d/msg/kubernetes-security-announce/vUtEcSEY6SM/v2ZZxsmtFQAJ","name":"v1.13.9, v1.14.5, v1.15.2 released to address CVE-2019-11247, CVE-2019-11249","refsource":"MLIST","tags":["Third Party Advisory"],"title":"Google Groups","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2019:2769","name":"RHSA-2019:2769","refsource":"REDHAT","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal - Access to 24x7 support and knowledge","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11247","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11247","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Prabu Shyam, Verizon Media","lang":""}],"nvd_cpes":[{"cve_year":"2019","cve_id":"11247","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kubernetes","cpe5":"kubernetes","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11247","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kubernetes","cpe5":"kubernetes","cpe6":"1.12.11","cpe7":"beta0","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11247","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kubernetes","cpe5":"kubernetes","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11247","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kubernetes","cpe5":"kubernetes","cpe6":"1.12.11","cpe7":"beta0","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11247","vulnerable":"1","versionEndIncluding":"1.12.10","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kubernetes","cpe5":"kubernetes","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11247","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"openshift_container_platform","cpe6":"3.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11247","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"openshift_container_platform","cpe6":"3.11","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11247","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"openshift_container_platform","cpe6":"3.9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11247","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"openshift_container_platform","cpe6":"3.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11247","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"openshift_container_platform","cpe6":"3.11","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"11247","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"openshift_container_platform","cpe6":"3.9","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2019-11247","qid":"377875","title":"Kubernetes API Server Allows Access Vulnerability"},{"cve":"CVE-2019-11247","qid":"501590","title":"Alpine Linux Security Update for k3s"},{"cve":"CVE-2019-11247","qid":"770003","title":"Red Hat OpenShift Container Platform 4.1.11 Security Update (RHSA-2019:2504)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"AKA":"","ASSIGNER":"security@kubernetes.io","DATE_PUBLIC":"2019-08-05","ID":"CVE-2019-11247","STATE":"PUBLIC","TITLE":"Kubernetes kube-apiserver allows access to custom resources via wrong scope"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Kubernetes","product":{"product_data":[{"product_name":"Kubernetes","version":{"version_data":[{"version_value":"prior to 1.13.9"},{"version_value":"prior to 1.14.5"},{"version_value":"prior to 1.15.2"},{"version_value":"1.7"},{"version_value":"1.8"},{"version_value":"1.9"},{"version_value":"1.10"},{"version_value":"1.11"},{"version_value":"1.12"}]}}]}}]}},"configuration":[],"credit":[{"lang":"eng","value":"Prabu Shyam, Verizon Media"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12."}]},"exploit":[],"generator":{"engine":"Vulnogram 0.0.7"},"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.0"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-20: Improper Input Validation"}]}]},"references":{"reference_data":[{"name":"https://github.com/kubernetes/kubernetes/issues/80983","refsource":"CONFIRM","url":"https://github.com/kubernetes/kubernetes/issues/80983"},{"name":"v1.13.9, v1.14.5, v1.15.2 released to address CVE-2019-11247, CVE-2019-11249","refsource":"MLIST","url":"https://groups.google.com/d/msg/kubernetes-security-announce/vUtEcSEY6SM/v2ZZxsmtFQAJ"},{"refsource":"REDHAT","name":"RHSA-2019:2690","url":"https://access.redhat.com/errata/RHSA-2019:2690"},{"refsource":"CONFIRM","name":"https://security.netapp.com/advisory/ntap-20190919-0003/","url":"https://security.netapp.com/advisory/ntap-20190919-0003/"},{"refsource":"REDHAT","name":"RHBA-2019:2816","url":"https://access.redhat.com/errata/RHBA-2019:2816"},{"refsource":"REDHAT","name":"RHBA-2019:2824","url":"https://access.redhat.com/errata/RHBA-2019:2824"},{"refsource":"REDHAT","name":"RHSA-2019:2769","url":"https://access.redhat.com/errata/RHSA-2019:2769"}]},"solution":[],"source":{"advisory":"","defect":["https://github.com/kubernetes/kubernetes/issues/80983"],"discovery":"USER"},"work_around":[{"lang":"eng","value":"To mitigate, remove authorization rules that grant access to cluster-scoped resources within namespaces. For example, RBAC roles and clusterroles intended to be referenced by namespaced rolebindings should not grant access to resources:[*], apiGroups:[*], or grant access to cluster-scoped custom resources."}]},"nvd":{"publishedDate":"2019-08-29 01:15:00","lastModifiedDate":"2020-10-02 16:21:00","problem_types":["CWE-863"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*","versionStartIncluding":"1.13.0","versionEndExcluding":"1.13.9","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*","versionStartIncluding":"1.14.0","versionEndExcluding":"1.14.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*","versionStartIncluding":"1.15.0","versionEndExcluding":"1.15.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:kubernetes:kubernetes:1.12.11:beta0:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*","versionStartIncluding":"1.7.0","versionEndIncluding":"1.12.10","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:openshift_container_platform:3.9:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:openshift_container_platform:3.10:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"11247","Ordinal":"149534","Title":"CVE-2019-11247","CVE":"CVE-2019-11247","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"11247","Ordinal":"1","NoteData":"The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"11247","Ordinal":"2","NoteData":"2019-08-28","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"11247","Ordinal":"3","NoteData":"2019-10-24","Type":"Other","Title":"Modified"}]}}}