CVE-2022-3172 — Server-Side Request Forgery in Kubernetes Apiserver

CWE-918 — Server-Side Request Forgery5 documents5 sources
Severity
8.2HIGHNVD
CNA5.1
EPSS
2.8%
top 13.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
KubernetesKubernetes ApiserverKubernetes Kube-apiserver
Timeline
PublishedNov 3

Description

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:NExploitability: 2.8 | Impact: 4.7

Affected Packages3 packages

▶NVDkubernetes/apiserver1.22.0 — 1.22.14+4
▶CVEListV5kubernetes/kube-apiserverv1.24.0 — v1.24.4+4
▶Debiankubernetes/kubernetes< 1.20.5+really1.20.2-1+3

🔴Vulnerability Details

2
OSV
CVE-2022-3172: A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL↗2023-11-03
▶
CVEList
Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)↗2023-11-03
▶

📋Vendor Advisories

2
Red Hat
kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF)↗2022-09-16
▶
Debian
CVE-2022-3172: kubernetes - A security issue was discovered in kube-apiserver that allows an aggregated API...↗2022
▶
CVE-2022-3172 — Server-Side Request Forgery | cvebase