title: Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
description: Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.
problem types: CWE-20: Improper Input Validation
affected:
{
vendor: Kubernetes
product: ingress-nginx
repo: https://github.com/kubernetes/ingress-nginx
versions:
status: affected, version: 0, lessThan: 1.9.0, versionType: semver
status: unknown, version: 1.9.0
defaultStatus: unknown
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: LOW
availabilityImpact: LOW
baseSeverity: HIGH
baseScore: 7.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
]