PT-2022-3992 · Nginx · Nginx Ingress Controller

Published 2022-08-04 · Updated 2023-11-06 · CVE-2022-30535

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions NGINX Ingress Controller versions 1.x and earlier NGINX Ingress Controller versions 2.x before 2.3.0

Description The issue is related to insufficient input validation, allowing an authorized attacker to obtain secrets available to the NGINX Ingress Controller by creating or updating ingress objects. This can lead to the disclosure of protected information.

Recommendations For versions 1.x, consider disabling the creation or update of ingress objects until a patch is available. For versions 2.x before 2.3.0, update to version 2.3.0 or later to resolve the issue. As a temporary workaround, restrict access to the NGINX Ingress Controller to minimize the risk of exploitation.

Fix

Information Disclosure

RCE

Weakness Enumeration

CWE-200

CWE-20

Related Identifiers

BDU:2022-04825

BIT-NGINX-INGRESS-CONTROLLER-2022-30535

CVE-2022-30535

Affected Products

Nginx Ingress Controller

References · 6

• https://support.f5.com/csp/article/K52125139 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nginx-ingress-controller-2022-30535 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30535 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04825 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-30535 · Security Note
• https://t.me/cibsecurity/47582 · Telegram Post