CVEvulnerability

CVE-2022-1902

8.8 HIGH Published 2022-09-01 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-09-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-497, CWE-668

Description

A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges.

Affected configurations

• redhat advanced cluster security 3.68 • redhat advanced cluster security 3.69 • redhat advanced cluster security 3.70

Related

Weakness · CWE (2)

  • CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References