Unauthorized read of Custom Resources
CVE-2022-3162

6.5MEDIUM

Key Information:

Vendor

Kubernetes
Status
Kubernetes
Vendor
CVE Published:
1 March 2023

What is CVE-2022-3162?

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Kubernetes <= unspecified

Kubernetes <= unspecified

Kubernetes <= unspecified

References

https://groups.google.com/g/kubernetes-security-announce/...
https://github.com/kubernetes/kubernetes/issues/113756
https://security.netapp.com/advisory/ntap-20230511-0004/

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Richard Turnbull of NCC Group
JSON
.