VDB
CVE-2022-1902
CVE-2022-1902
PUBLISHED
CVSS 8.800000190734863 HIGH
A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges.
EPSS 1.37% · 70.8th percentile
Risk Scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
1.37%
70.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| redhat | advanced_cluster_security | 3.68, 3.69, 3.70 |
| n/a | Red Hat Advanced Cluster Security for Kubernetes | Red Hat Advanced Cluster Security for Kubernetes 3 |
Timeline
- Sep 1, 2022 CVE Published
- Sep 2, 2022 EPSS Score
- Oct 18, 2022 EPSS Score
- Dec 3, 2022 EPSS Score
- Jan 18, 2023 EPSS Score
- Mar 5, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 19, 2023 EPSS Score
- Jun 4, 2023 EPSS Score
- Jul 20, 2023 EPSS Score
- Sep 4, 2023 EPSS Score
- Oct 20, 2023 EPSS Score
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2090957 url
- https://access.redhat.com/security/cve/CVE-2022-1902 url
- https://github.com/stackrox/stackrox/pull/1803 url
- https://nvd.nist.gov/vuln/detail/CVE-2022-1902 advisory
- https://access.redhat.com/errata/RHSA-2022:5132 url
- https://access.redhat.com/errata/RHSA-2022:5188 url
- https://access.redhat.com/errata/RHSA-2022:5189 url