PT-2022-3650 · Red Hat · Red Hat Advanced Cluster Security For Kubernetes

Avinash Hanwate · Published 2022-05-27 · Updated 2023-02-13 · CVE-2022-1902

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Security for Kubernetes (affected versions not specified)

Description A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes, related to insufficient protection of service data in the GraphQL API. This issue allows authenticated users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges. The flaw is associated with the inadequate sanitization of Notifier secrets in the GraphQL API.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-497

CWE-668

Related Identifiers

BDU:2022-04435

CVE-2022-1902

Affected Products

Red Hat Advanced Cluster Security For Kubernetes

References · 10

• 🔥 https://github.com/stackrox/stackrox/pull/1803 · Exploit
• https://bdu.fstec.ru/vul/2022-04435 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2090957 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2022-1902 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1902 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1902 · Vendor Advisory
• https://t.me/cvenotify/35609 · Telegram Post
• https://t.me/cvenotify/35825 · Telegram Post
• https://t.me/cvenotify/44159 · Telegram Post
• https://t.me/cibsecurity/49201 · Telegram Post