# CVSS v2: Single Authentication CVEs whose attacker must authenticate once (CVSS v2). Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-authentication/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs whose attacker must authenticate once (CVSS v2). Example 7 of 19 in **Filters › CVSS v2** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `metrics.cvss_metric_v2.cvss_data.authentication` · `operator` `eq` `metrics.cvss_metric_v2.cvss_data.authentication` is how many times an attacker must authenticate (`NONE`, `SINGLE` or `MULTIPLE`), in the CVSS v2 metric (`metrics.cvss_metric_v2`, one entry per scoring source). `eq` matches the exact value `SINGLE`. In the response, look at `results[].metrics.cvss_metric_v2[].cvss_data.authentication`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `metrics.cvss_metric_v2.cvss_data.authentication` | | `filters.must[0].type` | body | `eq` | | `filters.must[0].value` | body | `SINGLE` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "metrics.cvss_metric_v2.cvss_data.authentication", "type": "eq", "value": "SINGLE" } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 37410, "results": [ { "id": "CVE-2016-7457", "source_identifier": "user@vmware.com", "published": "2016-12-29T09:59:00Z", "last_modified": "2026-06-17T00:53:06Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to gain privileges, or halt and remove virtual machines, via unspecified vectors." }, { "lang": "es", "value": "VMware vRealize Operations (también conocido como vROps) 6.x en versiones anteriores a 6.4.0 permite a usuarios remotos autenticados obtener privilegios o detener y eliminar máquinas virtuales, a través de vectores no especificados." } ], "references": [ { "url": "http://www.securityfocus.com/bid/93499", "source": "user@vmware.com", "tags": [ "Third Party Advisory", "VDB Entry" ] }, { "url": "http://www.securitytracker.com/id/1036999", "source": "user@vmware.com", "tags": null }, { "url": "http://www.vmware.com/security/advisories/VMSA-2016-0016.html", "source": "user@vmware.com", "tags": [ "Vendor Advisory" ] }, { "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03707en_us", "source": "user@vmware.com", "tags": null }, { "url": "http://www.securityfocus.com/bid/93499", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "VDB Entry" ] }, { "url": "http://www.securitytracker.com/id/1036999", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.vmware.com/security/advisories/VMSA-2016-0016.html", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Vendor Advisory" ] }, { "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03707en_us", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": null, "cvss_metric_v30": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:S/C:P/I:P/A:C", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "SINGLE", "confidentiality_impact": "PARTIAL", "integrity_impact": "PARTIAL", "availability_impact": "COMPLETE", "base_score": 8.0, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "HIGH", "exploitability_score": 8.0, "impact_score": 8.5, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-264" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:vrealize_operations:6.0.0:*:*:*:*:*:*:*", "match_criteria_id": "7527E0FF-EDEE-45B9-859C-59CBEC0519E3", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:vrealize_operations:6.1.0:*:*:*:*:*:*:*", "match_criteria_id": "298BD34D-0F06-44F7-AD8B-424F266AE0DE", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:vrealize_operations:6.2.0a:*:*:*:*:*:*:*", "match_criteria_id": "DC0394A5-03BA-43ED-AA76-8E798279288C", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:vrealize_operations:6.2.1:*:*:*:*:*:*:*", "match_criteria_id": "5D166F44-FCB2-481A-A85B-DC581A72043A", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:vrealize_operations:6.3.0:*:*:*:*:*:*:*", "match_criteria_id": "C3C8FA12-B06F-4413-A3C9-DA15B5391D3E", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:vmware:vrealize_operations:6.0.0:*:*:*:*:*:*:*", "vendor": "vmware", "product": "vrealize_operations", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "6.0.0", "affected_versions_last": "6.0.0" }, { "criteria": "cpe:2.3:a:vmware:vrealize_operations:6.1.0:*:*:*:*:*:*:*", "vendor": "vmware", "product": "vrealize_operations", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "6.1.0", "affected_versions_last": "6.1.0" }, { "criteria": "cpe:2.3:a:vmware:vrealize_operations:6.2.0a:*:*:*:*:*:*:*", "vendor": "vmware", "product": "vrealize_operations", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "6.2.0a", "affected_versions_last": "6.2.0a" }, { "criteria": "cpe:2.3:a:vmware:vrealize_operations:6.2.1:*:*:*:*:*:*:*", "vendor": "vmware", "product": "vrealize_operations", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "6.2.1", "affected_versions_last": "6.2.1" }, { "criteria": "cpe:2.3:a:vmware:vrealize_operations:6.3.0:*:*:*:*:*:*:*", "vendor": "vmware", "product": "vrealize_operations", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "6.3.0", "affected_versions_last": "6.3.0" } ], "cwe": null, "epss_score": { "epss": 0.03183, "percentile": 0.87521, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.0", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2023-5223", "source_identifier": "user@vuldb.com", "published": "2023-09-27T15:19:43Z", "last_modified": "2026-06-17T06:48:07Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "A vulnerability, which was classified as critical, has been found in HimitZH HOJ up to 4.6-9a65e3f. This issue affects some unknown processing of the component Topic Handler. The manipulation leads to sandbox issue. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240365 was assigned to this vulnerability." }, { "lang": "es", "value": "Una vulnerabilidad fue encontrada en HimitZH HOJ hasta 4.6-9a65e3f y clasificada como crítica. Este problema afecta a un procesamiento desconocido del componente Topic Handler. La manipulación conduce a un problema de la sandbox. El ataque puede iniciarse de forma remota. El exploit ha sido divulgado al público y puede utilizarse. A esta vulnerabilidad se le asignó el identificador VDB-240365." } ], "references": [ { "url": "https://github.com/payI0ad/cves/issues/1", "source": "user@vuldb.com", "tags": [ "Exploit", "Issue Tracking", "Third Party Advisory" ] }, { "url": "https://vuldb.com/?ctiid.240365", "source": "user@vuldb.com", "tags": [ "Permissions Required", "Third Party Advisory" ] }, { "url": "https://vuldb.com/?id.240365", "source": "user@vuldb.com", "tags": [ "Third Party Advisory" ] }, { "url": "https://github.com/payI0ad/cves/issues/1", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Issue Tracking", "Third Party Advisory" ] }, { "url": "https://vuldb.com/?ctiid.240365", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Permissions Required", "Third Party Advisory" ] }, { "url": "https://vuldb.com/?id.240365", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@vuldb.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "LOW", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "LOW", "integrity_impact": "LOW", "availability_impact": "LOW", "base_score": 6.3, "base_severity": "MEDIUM", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 2.8, "impact_score": 3.4 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "LOW", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.9, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.1, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": [ { "source": "user@vuldb.com", "type": "Secondary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "SINGLE", "confidentiality_impact": "PARTIAL", "integrity_impact": "PARTIAL", "availability_impact": "PARTIAL", "base_score": 6.5, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "MEDIUM", "exploitability_score": 8.0, "impact_score": 6.4, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@vuldb.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-265" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:hdoi:hcode_online_judge:4.6-9a65e3f:*:*:*:*:*:*:*", "match_criteria_id": "327EC2FB-1344-48E5-8AE3-989D15729510", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:hdoi:hcode_online_judge:4.6-9a65e3f:*:*:*:*:*:*:*", "vendor": "hdoi", "product": "hcode_online_judge", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "4.6-9a65e3f", "affected_versions_last": "4.6-9a65e3f" } ], "cwe": null, "epss_score": { "epss": 0.00891, "percentile": 0.57924, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "LOW", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 9.9, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2022-24817", "source_identifier": "user@github.com", "published": "2022-05-06T00:15:07Z", "last_modified": "2026-06-17T04:32:35Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions. Workarounds include disabling functionality via Validating Admission webhooks by restricting users from setting the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects. Additional mitigations include applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed. This vulnerability is fixed in kustomize-controller v0.23.0 and helm-controller v0.19.0, both included in flux2 v0.29.0" }, { "lang": "es", "value": "Flux2 es una solución de entrega continua abierta y extensible para Kubernetes. Las versiones de Flux2 entre 0.1.0 y 0.29.0, helm-controller versiones 0.1.0 a v0.19.0, y kustomize-controller versiones 0.1.0 a v0.23.0 son vulnerables a la inyección de código por medio de un Kubeconfig malicioso. En los despliegues multi-tenancy esto también puede conllevar una escalada de privilegios si la cuenta de servicio del controlador presenta permisos elevados. Las mitigaciones incluyen deshabilitar la funcionalidad por medio de los webhooks de Comprobación de Admisión restringiendo a los usuarios la configuración del campo \"spec.kubeConfig\" en los objetos Flux \"Kustomization\" y \"HelmRelease\". Las mitigaciones adicionales incluyen la aplicación de perfiles restrictivos de AppArmor y SELinux en el pod del controlador para limitar los binarios que pueden ejecutarse. Esta vulnerabilidad está corregida en kustomize-controller versión v0.23.0 y helm-controller versión v0.19.0, ambos incluidos en flux2 versión v0.29.0" } ], "references": [ { "url": "https://github.com/fluxcd/flux2/security/advisories/GHSA-vvmq-fwmg-2gjc", "source": "user@github.com", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://github.com/fluxcd/flux2/security/advisories/GHSA-vvmq-fwmg-2gjc", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@github.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "LOW", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.9, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.1, "impact_score": 6.0 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "LOW", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.9, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.1, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "access_vector": "NETWORK", "access_complexity": "LOW", "authentication": "SINGLE", "confidentiality_impact": "PARTIAL", "integrity_impact": "PARTIAL", "availability_impact": "PARTIAL", "base_score": 6.5, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "MEDIUM", "exploitability_score": 8.0, "impact_score": 6.4, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@github.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-94" } ] }, { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-94" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:fluxcd:flux2:*:*:*:*:*:*:*:*", "match_criteria_id": "3B093724-43C4-4D99-A3B7-D0BC5680B9AE", "version_start_including": "0.1.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "0.29.0" }, { "vulnerable": true, "criteria": "cpe:2.3:a:fluxcd:helm-controller:*:*:*:*:*:*:*:*", "match_criteria_id": "C6A8DB05-A4C1-4E2A-93DA-610265FFC1BF", "version_start_including": "0.2.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "0.19.0" }, { "vulnerable": true, "criteria": "cpe:2.3:a:fluxcd:kustomize-controller:*:*:*:*:*:*:*:*", "match_criteria_id": "E49D128E-5A7E-4B2D-85E6-B1643A7ACC04", "version_start_including": "0.1.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "0.23.0" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:fluxcd:flux2:*:*:*:*:*:*:*:*", "vendor": "fluxcd", "product": "flux2", "product_type": "a", "vulnerable": true, "version_start_including": "0.1.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "0.29.0", "affected_versions_first": "0.1.0", "affected_versions_last": "0.28.5" }, { "criteria": "cpe:2.3:a:fluxcd:helm-controller:*:*:*:*:*:*:*:*", "vendor": "fluxcd", "product": "helm-controller", "product_type": "a", "vulnerable": true, "version_start_including": "0.2.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "0.19.0", "affected_versions_first": "0.2.0", "affected_versions_last": "0.18.2" }, { "criteria": "cpe:2.3:a:fluxcd:kustomize-controller:*:*:*:*:*:*:*:*", "vendor": "fluxcd", "product": "kustomize-controller", "product_type": "a", "vulnerable": true, "version_start_including": "0.1.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "0.23.0", "affected_versions_first": "0.1.0", "affected_versions_last": "0.22.3" } ], "cwe": [ { "id": 94, "owasptop10_2021": "A03 Injection", "name": "Improper Control of Generation of Code ('Code Injection')", "description": "The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.", "capec_id": [ 35, 77, 242 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity", "Non-Repudiation" ], "impact": [ "Bypass Protection Mechanism", "Execute Unauthorized Code or Commands", "Gain Privileges or Assume Identity", "Hide Activities" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.01101, "percentile": 0.64277, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "LOW", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 9.9, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [CVSS v2: Medium Access Complexity](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-access-complexity/) - [CVSS v2: Complete Confidentiality Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-confidentiality-impact/) - [CVSS v2: Local Access Vector](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-access-vector/) - [CVSS v2: Partial Integrity Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-integrity-impact/) - [CVSS v2: Remote, No Authentication, Complete Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-vector-string/) - [CVSS v2: No Availability Impact](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-cvss-data-availability-impact/)