PT-2022-20897

CVE-2022-3172

Published

2022-09-16

Updated

2023-12-21

Description by

CVSS 3.1

8.2

High

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions kube-apiserver (affected versions not specified)

Description A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Nicolas Joly

Weinong

Weinong Wang

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)