CVE-2022-30535CWE-20

NGINX Ingress Controller vulnerability CVE-2022-30535

Medium · published August 4, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
53.2
In the wild
Unconfirmed
What it is

In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00714 · 53.2th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2022-08-04T17:45Z
EPSS history
Timeline
  • 04 AUG 17:45Z
    NGINX Ingress Controller vulnerability CVE-2022-30535
    cvelistv5