CVEvulnerability

CVE-2022-28224

5.5 MEDIUM Published 2022-06-06 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2022-06-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
CVSS 2.0 ([email protected])
5.5 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:P
Weaknesses
CWE-20, CWE-200, CWE-201

Description

Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP feature. Due to insufficient validation, a privileged attacker may be able to set a floating IP annotation to a pod even if the feature is not enabled. This may allow the attacker to intercept and reroute traffic to their compromised pod.

Affected configurations

• tigera calico (< 3.20.5) • tigera calico (>= 3.21.0 < 3.21.5) • tigera calico (>= 3.22.0 < 3.22.2) • tigera calico enterprise (< 3.11.4) • tigera calico enterprise 3.12.0

Related

Weakness · CWE (3)

  • CWE-20 Improper Input Validation weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness

References