PT-2022-3916 · Unknown · Pinniped Supervisor

Cfryanr · Published 2022-05-11 · Updated 2024-03-06 · CVE-2022-22975

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pinniped Supervisor (affected versions not specified)

Description An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. The issue allows an attack where a malicious user changes the common name (CN) of their user entry on the LDAP or AD server to include special characters. These special characters could be used to perform LDAP query injection on the Supervisor's LDAP query, which determines their Kubernetes group membership.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2022-04734

BIT-PINNIPED-2022-22975

CVE-2022-22975

GHSA-HVRF-5HHV-4348

Affected Products

Pinniped Supervisor

References · 8

• https://osv.dev/vulnerability/BIT-pinniped-2022-22975 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04734 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22975 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22975 · Security Note
• https://github.com/vmware-tanzu/pinniped/security/advisories/GHSA-hvrf-5hhv-4348 · Note
• https://t.me/cvenotify/30466 · Telegram Post
• https://vuldb.com/ru/?id.199516 · Note
• https://t.me/cibsecurity/42396 · Telegram Post