« Volver al listado

CVE-2022-37968

Estado: ModificadaCrítica (10)—

Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microsoft — Azure Arc-enabled KubernetesMicrosoft — Azure Stack Edge

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-37968",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Azure Arc-enabled Kubernetes cluster 1.8.11",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "1.8.11",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Unknown"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Azure Arc-enabled Kubernetes cluster 1.7.18",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "1.7.18",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Unknown"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Azure Arc-enabled Kubernetes cluster 1.5.8",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "1.5.8",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Unknown"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Azure Arc-enabled Kubernetes cluster 1.6.19",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0",
              "lessThan": "1.6.19",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Unknown"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Azure Stack Edge",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.0",
              "lessThan": "2.2.2088.5593",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Unknown"
          ]
        }
      ]
    }
  ],
  "published": "2022-10-11T19:15:12.030",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37968",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-37968",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de elevación de privilegios en el clúster Kubernetes habilitado por Azure Arc Connect."
    }
  ],
  "lastModified": "2026-06-17T04:55:48.023",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.5.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA81E2BC-4E48-476E-A95C-B92A998D94C4"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.6.19:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E95FFD62-CE22-4AC6-985C-0EC02D93EA6E"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.7.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6984E045-070D-47F9-A6F7-B6EFE45AECE9"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.8.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90EC0CE4-C6D5-4B24-A3DA-ED0D2D223C82"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:azure_stack_edge:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "569FC1EE-DB05-4ABF-9011-3E4D9C826D1D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}