CVE-2023-36815
Assigner: GitHub_M
Published: 2023-07-03T17:44:28.932Z
State: PUBLISHED
title: Sealos billing system permission control defect
problemTypes: descriptions: cweId: CWE-862
description: CWE-862: Missing Authorization
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
affected: vendor: labring
product: sealos
versions: version: <= 4.2.0
status: affected
descriptions: value: Sealos is a Cloud Operating System designed for managing cloud-native applications. In version 4.2.0 and prior, there is a permission flaw in the Sealos billing system, which allows users to control the recharge resource account `sealos[.] io/v1/Payment`, resulting in the ability to recharge any amount of 1 renminbi (RMB). The charging interface may expose resource information. The namespace of this custom resource would be user's control and may have permission to correct it. It is not clear whether a fix exists.
source: advisory: GHSA-vpxf-q44g-w34w
discovery: UNKNOWN