Kubernetes CVE-2023-5044

HIGH

Improper Input Validation (CWE-20)

2023-10-25 jordan@liggitt.net

Kubernetes Code Injection Nginx Ingress Nginx

8.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Oct 25, 2023 - 20:15 nvd

HIGH 8.8

DescriptionNVD

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.

AnalysisAI

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation. Affected products include: Kubernetes Ingress-Nginx.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Kubernetes

View all

CVE-2025-1974 CRITICAL Act Now POC

A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access

CVE-2026-45321 CRITICAL Act Now POC

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio

CVE-2025-1098 HIGH Act Now POC

Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress

CVE-2025-24514 HIGH Act Now POC

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres

CVE-2025-1097 HIGH Act Now POC

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c

CVE-2020-8554 MEDIUM This Month POC

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter

CVE-2025-55190 CRITICAL Act Now POC

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne

CVE-2018-18843 CRITICAL Act Now POC

The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4

CVE-2026-22039 CRITICAL Act Now POC

Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass

CVE-2024-42480 CRITICAL Act Now POC

Kamaji is the Hosted Control Plane Manager for Kubernetes. Rated critical severity (CVSS 9.9), this vulnerability is rem

CVE-2023-28110 CRITICAL Act Now POC

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, ref

CVE-2026-25996 CRITICAL Act Now POC

String filter bypass in Inspektor Gadget Kubernetes eBPF tooling before fix. Insufficient string escaping enables filter

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

CVE-2024-3400 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2023-22515 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2017-9791 CRITICAL POC

CVE-2017-15944 CRITICAL POC

CVE-2019-0604 CRITICAL POC

Same technique Code Injection

View all

CVE-2012-0158 HIGH POC

CVE-2014-6287 CRITICAL POC

CVE-2017-7494 CRITICAL POC

CVE-2025-24893 CRITICAL POC

CVE-2025-47812 CRITICAL POC

CVE-2013-3906 HIGH POC

CVE-2017-9822 HIGH POC

CVE-2018-1273 CRITICAL POC

Share

CVE-2023-5044 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy