Search a vulnerability

All the vulnerabilites related to Kubernetes - kube-apiserver

cve-2022-3172

Vulnerability from cvelistv5

Published

2023-11-03 18:11

Modified

2024-08-03 01:00

Severity ?

5.1 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L

Summary

Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)

References

▼	URL	Tags
	https://github.com/kubernetes/kubernetes/issues/112513	issue-tracking
	https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak	mailing-list
	https://security.netapp.com/advisory/ntap-20231221-0005/

Impacted products

▼	Vendor	Product
	Kubernetes	kube-apiserver

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:00:10.775Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "issue-tracking",
              "x_transferred"
            ],
            "url": "https://github.com/kubernetes/kubernetes/issues/112513"
          },
          {
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231221-0005/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "kube-apiserver",
          "repo": "https://github.com/kubernetes/kubernetes",
          "vendor": "Kubernetes",
          "versions": [
            {
              "status": "affected",
              "version": "v1.25.0"
            },
            {
              "lessThanOrEqual": "v1.24.4",
              "status": "affected",
              "version": "v1.24.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "v1.23.10",
              "status": "affected",
              "version": "v1.23.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "v1.22.13",
              "status": "affected",
              "version": "v1.22.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "v1.25.1"
            },
            {
              "status": "unaffected",
              "version": "v1.24.5"
            },
            {
              "status": "unaffected",
              "version": "v1.23.11"
            },
            {
              "status": "unaffected",
              "version": "v1.22.14"
            },
            {
              "lessThanOrEqual": "v1.21.14",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Nicolas Joly"
        },
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Weinong Wang"
        }
      ],
      "datePublic": "2022-09-16T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A security issue was discovered in kube-apiserver that allows an \naggregated API server to redirect client traffic to any URL.  This could\n lead to the client performing unexpected actions as well as forwarding \nthe client\u0027s API server credentials to third parties.\u003cbr\u003e"
            }
          ],
          "value": "A security issue was discovered in kube-apiserver that allows an \naggregated API server to redirect client traffic to any URL.  This could\n lead to the client performing unexpected actions as well as forwarding \nthe client\u0027s API server credentials to third parties.\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-560",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-560 Use of Known Domain Credentials"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-03T18:11:53.835Z",
        "orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
        "shortName": "kubernetes"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/kubernetes/kubernetes/issues/112513"
        },
        {
          "tags": [
            "mailing-list"
          ],
          "url": "https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231221-0005/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
    "assignerShortName": "kubernetes",
    "cveId": "CVE-2022-3172",
    "datePublished": "2023-11-03T18:11:53.835Z",
    "dateReserved": "2022-09-09T15:59:49.064Z",
    "dateUpdated": "2024-08-03T01:00:10.775Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2023-1260