从这个网页截图中，可以获取到以下关于漏洞的关键信息： 1. 漏洞名称：PolicyException objects can be created in any namespace by default 2. 严重性：High 3. 发布者：realshuting 4. CVE ID：CVE-2024-48921 5. 受影响的版本范围：<1.13.0 6. 已修复的版本：1.13.0 7. 描述： - A kyverno ClusterPolicy, i.e. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. - By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. 8. PoC： 1. Administrator creates "disallow-privileged-containers" ClusterPolicy that applies to resources in the namespace "ubuntu-restricted" 2. Cluster user creates a PolicyException object for "disallow-privileged-containers" in namespace "ubuntu-restricted" 3. Cluster user creates a pod with a privileged container in "ubuntu-restricted" 4. Cluster user escalates to root on the node from the privileged container 9. 影响： - Administrators attempting to enforce cluster security through kyverno policies, but that allow less privileged users to create resources 这些信息可以帮助理解漏洞的性质、影响范围以及如何利用漏洞。