CVE-2022-3162
Unauthorized read of Custom Resources
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.
A flaw was found in kubernetes. Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different kind in the same API group they are not authorized to read.
Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge device deployments and is built from the edge capabilities of Red Hat OpenShift. MicroShift is an application that is deployed on top of Red Hat Enterprise Linux devices at the edge, providing an efficient way to operate single-node clusters in these low-resource environments. This advisory contains the RPM packages for Red Hat build of MicroShift 4.12.4.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2022-09-08 CVE Reserved
- 2023-01-18 CVE Published
- 2025-03-07 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-23: Relative Path Traversal
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20230511-0004 |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/kubernetes/kubernetes/issues/113756 | 2023-05-11 | |
| https://groups.google.com/g/kubernetes-security-announce/c/iUd550j7kjA | 2023-05-11 | |
| https://access.redhat.com/security/cve/CVE-2022-3162 | 2023-02-20 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2136673 | 2023-02-20 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | <= 1.22.15 Search vendor "Kubernetes" for product "Kubernetes" and version " <= 1.22.15" | - |
Affected
| ||||||
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.23.0 <= 1.23.13 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.23.0 <= 1.23.13" | - |
Affected
| ||||||
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.24.0 <= 1.24.7 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.24.0 <= 1.24.7" | - |
Affected
| ||||||
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.25.0 <= 1.25.3 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.25.0 <= 1.25.3" | - |
Affected
| ||||||