What is CVE-2020-15186?

CVE-2020-15186 is a low-severity vulnerability in Helm, classified under Improper Input Validation. CVSS score: 3.4/10. Published 2020-09-17.

How severe is CVE-2020-15186?

Low severity. CVSS v3 base score is 3.4 out of 10.

Improper input validation in Helm

CVE-2020-15186

In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of anoth…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.002 (46.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.4 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N.

Affected products

Helm — versions >= 2.0.0, < 2.16.11, >= 3.0.0, < 3.3.2

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

github.com/helm/helm/security/advisories/GHSA-m54r-vrmv-hw33 (x_refsource_CONFIRM)
github.com/helm/helm/commit/809e2d999e2c33e20e77f6bff30652d79c287542 (x_refsource_MISC)

Frequently asked questions

What is CVE-2020-15186?: CVE-2020-15186 is a low-severity vulnerability in Helm, classified under Improper Input Validation. CVSS score: 3.4/10. Published 2020-09-17.
How severe is CVE-2020-15186?: Low severity. CVSS v3 base score is 3.4 out of 10.