« Volver al listado

CVE-2022-1902

Estado: ModificadaAlta (8.8)—

A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Redhat — Advanced Cluster Security

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-1902",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Red Hat Advanced Cluster Security for Kubernetes",
          "versions": [
            {
              "status": "affected",
              "version": "Red Hat Advanced Cluster Security for Kubernetes 3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-09-01T21:15:09.110",
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2022-1902",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2090957",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/stackrox/stackrox/pull/1803",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2022-1902",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2090957",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/stackrox/stackrox/pull/1803",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-497"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado un fallo en Red Hat Advanced Cluster Security for Kubernetes. Los secretos de los notificadores no estaban apropiadamente saneados en la API GraphQL. Este fallo permite a usuarios autenticados de ACS recuperar notificadores de la API GraphQL, revelando secretos que pueden escalar sus privilegios"
    }
  ],
  "lastModified": "2026-06-17T04:23:19.673",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:advanced_cluster_security:3.68:*:*:*:*:kubernates:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51FFDA7E-C834-4B52-8217-5FC4E0AD9CA0"
            },
            {
              "criteria": "cpe:2.3:a:redhat:advanced_cluster_security:3.69:*:*:*:*:kubernates:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DE29924-BE2A-4238-9AE7-50C66741BCF3"
            },
            {
              "criteria": "cpe:2.3:a:redhat:advanced_cluster_security:3.70:*:*:*:*:kubernates:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0CB462DE-E208-41A6-BD64-934276163329"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}