Search
Find a vulnerability
Search criteria
2 vulnerabilities found for apiserver by kubernetes
CVE-2022-3172 (GCVE-0-2022-3172)
Vulnerability from nvd – Published: 2023-11-03 18:11 – Updated: 2025-02-13 16:32
VLAI
Title
Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)
Summary
A security issue was discovered in kube-apiserver that allows an
aggregated API server to redirect client traffic to any URL. This could
lead to the client performing unexpected actions as well as forwarding
the client's API server credentials to third parties.
Severity
5.1 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/kubernetes/kubernetes/issues/112513 | issue-tracking |
| https://groups.google.com/g/kubernetes-security-a… | mailing-list |
| https://security.netapp.com/advisory/ntap-2023122… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kubernetes | kube-apiserver |
Affected:
v1.25.0
Affected: v1.24.0 , ≤ v1.24.4 (semver) Affected: v1.23.0 , ≤ v1.23.10 (semver) Affected: v1.22.0 , ≤ v1.22.13 (semver) Unaffected: v1.25.1 Unaffected: v1.24.5 Unaffected: v1.23.11 Unaffected: v1.22.14 Affected: 0 , ≤ v1.21.14 (semver) |
Date Public
2022-09-16 04:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:00:10.775Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"issue-tracking",
"x_transferred"
],
"url": "https://github.com/kubernetes/kubernetes/issues/112513"
},
{
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20231221-0005/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "kube-apiserver",
"repo": "https://github.com/kubernetes/kubernetes",
"vendor": "Kubernetes",
"versions": [
{
"status": "affected",
"version": "v1.25.0"
},
{
"lessThanOrEqual": "v1.24.4",
"status": "affected",
"version": "v1.24.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "v1.23.10",
"status": "affected",
"version": "v1.23.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "v1.22.13",
"status": "affected",
"version": "v1.22.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "v1.25.1"
},
{
"status": "unaffected",
"version": "v1.24.5"
},
{
"status": "unaffected",
"version": "v1.23.11"
},
{
"status": "unaffected",
"version": "v1.22.14"
},
{
"lessThanOrEqual": "v1.21.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Nicolas Joly"
},
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Weinong Wang"
}
],
"datePublic": "2022-09-16T04:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A security issue was discovered in kube-apiserver that allows an \naggregated API server to redirect client traffic to any URL. This could\n lead to the client performing unexpected actions as well as forwarding \nthe client\u0027s API server credentials to third parties.\u003cbr\u003e"
}
],
"value": "A security issue was discovered in kube-apiserver that allows an \naggregated API server to redirect client traffic to any URL. This could\n lead to the client performing unexpected actions as well as forwarding \nthe client\u0027s API server credentials to third parties."
}
],
"impacts": [
{
"capecId": "CAPEC-560",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-560 Use of Known Domain Credentials"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-21T22:06:19.134Z",
"orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"shortName": "kubernetes"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/kubernetes/kubernetes/issues/112513"
},
{
"tags": [
"mailing-list"
],
"url": "https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231221-0005/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"assignerShortName": "kubernetes",
"cveId": "CVE-2022-3172",
"datePublished": "2023-11-03T18:11:53.835Z",
"dateReserved": "2022-09-09T15:59:49.064Z",
"dateUpdated": "2025-02-13T16:32:41.378Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-3172 (GCVE-0-2022-3172)
Vulnerability from cvelistv5 – Published: 2023-11-03 18:11 – Updated: 2025-02-13 16:32
VLAI
Title
Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)
Summary
A security issue was discovered in kube-apiserver that allows an
aggregated API server to redirect client traffic to any URL. This could
lead to the client performing unexpected actions as well as forwarding
the client's API server credentials to third parties.
Severity
5.1 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/kubernetes/kubernetes/issues/112513 | issue-tracking |
| https://groups.google.com/g/kubernetes-security-a… | mailing-list |
| https://security.netapp.com/advisory/ntap-2023122… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Kubernetes | kube-apiserver |
Affected:
v1.25.0
Affected: v1.24.0 , ≤ v1.24.4 (semver) Affected: v1.23.0 , ≤ v1.23.10 (semver) Affected: v1.22.0 , ≤ v1.22.13 (semver) Unaffected: v1.25.1 Unaffected: v1.24.5 Unaffected: v1.23.11 Unaffected: v1.22.14 Affected: 0 , ≤ v1.21.14 (semver) |
Date Public
2022-09-16 04:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:00:10.775Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"issue-tracking",
"x_transferred"
],
"url": "https://github.com/kubernetes/kubernetes/issues/112513"
},
{
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20231221-0005/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "kube-apiserver",
"repo": "https://github.com/kubernetes/kubernetes",
"vendor": "Kubernetes",
"versions": [
{
"status": "affected",
"version": "v1.25.0"
},
{
"lessThanOrEqual": "v1.24.4",
"status": "affected",
"version": "v1.24.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "v1.23.10",
"status": "affected",
"version": "v1.23.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "v1.22.13",
"status": "affected",
"version": "v1.22.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "v1.25.1"
},
{
"status": "unaffected",
"version": "v1.24.5"
},
{
"status": "unaffected",
"version": "v1.23.11"
},
{
"status": "unaffected",
"version": "v1.22.14"
},
{
"lessThanOrEqual": "v1.21.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Nicolas Joly"
},
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Weinong Wang"
}
],
"datePublic": "2022-09-16T04:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A security issue was discovered in kube-apiserver that allows an \naggregated API server to redirect client traffic to any URL. This could\n lead to the client performing unexpected actions as well as forwarding \nthe client\u0027s API server credentials to third parties.\u003cbr\u003e"
}
],
"value": "A security issue was discovered in kube-apiserver that allows an \naggregated API server to redirect client traffic to any URL. This could\n lead to the client performing unexpected actions as well as forwarding \nthe client\u0027s API server credentials to third parties."
}
],
"impacts": [
{
"capecId": "CAPEC-560",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-560 Use of Known Domain Credentials"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-21T22:06:19.134Z",
"orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"shortName": "kubernetes"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/kubernetes/kubernetes/issues/112513"
},
{
"tags": [
"mailing-list"
],
"url": "https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231221-0005/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
"assignerShortName": "kubernetes",
"cveId": "CVE-2022-3172",
"datePublished": "2023-11-03T18:11:53.835Z",
"dateReserved": "2022-09-09T15:59:49.064Z",
"dateUpdated": "2025-02-13T16:32:41.378Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}