CVE-2022-4318CWE-538

Cri-o: /etc/passwd tampering privesc

High · published September 25, 2023

CVSS v3.1
7.8
EPSS
0%
Percentile
20.5
In the wild
Unconfirmed
What it is

A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00290 · 20.5th percentile
Weakness
CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory
Published
2023-09-25T19:23Z
EPSS history
Timeline
  • 25 SEP 19:23Z
    Cri-o: /etc/passwd tampering privesc
    cvelistv5