{"schemaVersion":3,"id":"CVE-2022-1902","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges.","dates":{"published":"2022-09-01T19:54:44.000Z","modified":"2024-08-03T00:17:00.984Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01371,"percentile":0.7155,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01371},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01362,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01362,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01362,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01362,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01371,"percentile":0.7155}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01371,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01371,"percentile":0.7155}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_STACKROX_STACKROX","name":"Stackrox","source":"github","url":"https://github.com/stackrox/stackrox/pull/1803","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-497","name":"Exposure of Sensitive System Information to an Unauthorized Control Sphere","description":"The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/497.html"},{"id":"CWE-668","name":"Exposure of Resource to Wrong Sphere","description":"The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/668.html"}],"affected":[{"vendor":"redhat","product":"advanced_cluster_security","name":"advanced cluster security","label":"advanced_cluster_security","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"3.68","noFixRecorded":false,"fixedIn":null},{"text":"3.69","noFixRecorded":false,"fixedIn":null},{"text":"3.70","noFixRecorded":false,"fixedIn":null}],"versionsText":"3.68 | 3.69 | 3.70","eol":null,"hubHref":"/vendor/redhat/advanced_cluster_security"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2090957","label":"bugzilla.redhat.com/show_bug.cgi?id=2090957","hostname":"bugzilla.redhat.com","tags":["X Refsource MISC","Issue Tracking","Vendor Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1902","label":"access.redhat.com/security/cve/CVE-2022-1902","hostname":"access.redhat.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://github.com/stackrox/stackrox/pull/1803","label":"github.com/stackrox/stackrox/pull/1803","hostname":"github.com","tags":["X Refsource MISC","Exploit","Patch","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-09-01T19:54:44.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-03T00:17:00.984Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":45,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T23:04:16.537Z","stale":false,"partial":false}}