CVE-2019-11248

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.

CVSS v3.1

8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

CVSS v3.0

6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

CVSS v2.0

6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P

EPSS

75.06% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high

Published

2019-08-29

Updated

2024-09-17

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11248.yaml

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2019/CVE-2019-11248.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2019-1124
• CVE-2019-1125
• CVE-2019-11231
• CVE-2019-11253
• CVE-2019-1123
• CVE-2019-11269