CVE-2023-38495

HighCVSS 8.3

Published: 27/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.72%

49th percentile - higher than 49% of all known CVEs

Summary

In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of packages, allowing attackers to tamper with them undetected. The issue has been fixed in versions 1.11.5, 1.12.3, and 1.13.0.

Risk Assessment

The lack of package validation may lead to the introduction of malicious code into the environment, posing a serious security threat to the organization.

Recommendation

It is recommended to upgrade to versions 1.11.5, 1.12.3, or 1.13.0 and restrict package editing/creating privileges to administrators only.

Other vulnerabilities in Crossplane

CVE-2023-37900Low
In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane allows high-privileged users to create Packages referencing arbitrarily large images. This could lead to exhausting available memory and result in the container being OOMKilled.

Original NVD description (English source)

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package. The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0. As a workaround, only use images from trusted sources and keep Package editing/creating privileges to administrators only.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS