aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9
Date: 2022-07
Affected: go/sigs.k8s.io/aws-iam-authenticator
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2022-2385
CWE: CWE-20
CVSS: 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)

A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.


Mitigations:

Architectural layers (MAESTRO):