CVE-2022-4886 — Improper Input Validation in Kubernetes Ingress-nginx

CWE-20 — Improper Input Validation5 documents5 sources
Severity
6.5MEDIUMNVD
CNA8.8
EPSS
0.2%
top 55.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Kubernetes Ingress-nginxK8s.io Ingress-nginx
Timeline
PublishedOct 25
Latest updateDec 1

Description

Ingress-nginx `path` sanitization can be bypassed with `log_format` directive.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5kubernetes/ingress-nginx< 1.8.0

🔴Vulnerability Details

3
GHSA
Ingress-nginx path sanitization can be bypassed↗2023-10-25
▶
CVEList
Ingress-nginx `path` sanitization can be bypassed with `log_format` directive↗2023-10-25
▶
OSV
Ingress-nginx path sanitization can be bypassed↗2023-10-25
▶

🕵️Threat Intelligence

1
Wiz
Crying Out Cloud - December Newsletter | Wiz↗2023-12-01
▶
CVE-2022-4886 — Improper Input Validation in Kubernetes | cvebase