CVE-2022-3162CWE-23

Unauthorized read of Custom Resources

Medium · published March 1, 2023

CVSS v3.1
6.5
EPSS
1%
Percentile
67.7
In the wild
Unconfirmed
What it is

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01191 · 67.7th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2023-03-01T00:00Z
EPSS history
Timeline
  • 01 MAR 00:00Z
    Unauthorized read of Custom Resources
    cvelistv5