CVE-2022-1902: redhat advanced_cluster_security
CVSS: 8.8v3.1HighModified
Published 01-09-2022Last modified 03-08-2024
Vulnerability summary
CVE-2022-1902 is a high (CVSS 8.8) vulnerability in redhat advanced_cluster_security. EPSS estimates a 1.37% chance of exploitation in the next 30 days, higher than 71.5% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
1.37%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Timeline
- 01-09-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges.
CVSS metrics
1 score · 1 source · 1 versionHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
EPSS trend
Probability
1.37%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
0.00 pp
From 1.37% on 20-09-2026
20-09-202620-10-2026
EPSS score1.37%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundStackrox
Maturity: poc
Weaknesses
CWE · root cause- CWE-497Exposure of Sensitive System Information to an Unauthorized Control SphereThe product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
- CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Affected systems
Redhat1 product
- advanced_cluster_security3.68 | 3.69 | 3.70
1 vendor · 1 product