CVE-2022-3248 — Incorrect Authorization in Redhat Openshift Container Platform

CWE-863 — Incorrect Authorization4 documents4 sources
Severity
7.5HIGHNVD
CNA4.4
EPSS
0.1%
top 84.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat Advanced Cluster Management FOR KubernetesRedhat Openshift Container Platform
Timeline
PublishedOct 5

Description

A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

Also affects: Openshift Container Platform 4.0

🔴Vulnerability Details

2
GHSA
GHSA-4rc4-8xqr-5g82: A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions↗2023-10-05
▶
CVEList
Openshift api admission checks does not enforce "custom-host" permissions↗2023-10-05
▶

📋Vendor Advisories

1
Red Hat
kubernetes: OpenShift API admission checks does not enforce "custom-host" permissions↗2023-10-05
▶
CVE-2022-3248 — Incorrect Authorization in Redhat | cvebase