9.3

CVE-2022-1996: Authorization Bypass Through User-Controlled Key in emicklei/go-restful

Modified
AliasesSUSE-SU-2022:3334-1SUSE-SU-2022:3335-1SUSE-SU-2023:4727-1
Published 06-06-2022Last modified 03-08-2024

Vulnerability summary

CVE-2022-1996 is a critical (CVSS 9.3) vulnerability in emicklei emicklei/go-restful. EPSS estimates a 3.12% chance of exploitation in the next 30 days, higher than 87.8% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
9.3/10
010
Critical · v3.0 (CVE.org)
EPSS score
3.12%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 10 · Related 14
OPENSUSE-SU-2022:10094-1OPENSUSE-SU-2025:15779-1RHSA-2022:6042SUSE-SU-2022:3321-1SUSE-SU-2022:3333-1SUSE-SU-2022:3666-1

Timeline

  1. 06-06-2022
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

CVSS metrics

12 scores · 9 sources · 3 versions

EPSS trend

Probability

3.12%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

No change 0.00 pp

From 3.12% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (huntr.dev)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Suse51 products
  • aws-iam-authenticator&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP2< 0.5.3-150000.1.12.1
  • aws-iam-authenticator&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP3< 0.5.3-150000.1.12.1
  • aws-iam-authenticator&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4< 0.5.3-150000.1.12.1
  • aws-iam-authenticator&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP5< 0.5.3-150000.1.12.1
  • aws-iam-authenticator&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP6< 0.5.3-150000.1.12.1
Chainguard27 products
  • kube-state-metrics-2.6< 2.6.0-r1
  • kubeflow< 1.10.0-r3
  • kubeflow-access-management< 1.10.0-r3
  • kubeflow-access-management-compat< 1.10.0-r3
  • kubeflow-access-management-fips< 1.10.0-r2
Opensuse16 products
  • aws-iam-authenticator&distro=openSUSE Leap 15.5< 0.5.3-150000.1.12.1
  • aws-iam-authenticator&distro=openSUSE Leap 15.6< 0.5.3-150000.1.12.1
  • containerd&distro=openSUSE Leap 15.4< 1.7.8-150000.103.1
  • containerd&distro=openSUSE Leap 15.5< 1.7.8-150000.103.1
  • containerd&distro=openSUSE Leap Micro 5.3< 1.7.8-150000.103.1
Wolfi13 products
  • kubeflow< 1.10.0-r3
  • kubeflow-access-management< 1.10.0-r3
  • kubeflow-access-management-compat< 1.10.0-r3
  • kubeflow-admission-webhook< 1.10.0-r3
  • kubeflow-admission-webhook-compat< 1.10.0-r3
Github.com/emicklei/go-restful2 products
  • v2≤ 2.7.1 | ≥ 2.7.1 (No fix recorded)
  • v3≥ 3.0.0, < 3.8.0
Redhat2 products
  • openshift-gitops-kam< 0:1.8.3-6.el8 | < 0:1.9.0-102.el8
  • openshift-gitops-kam-redistributable< 0:1.8.3-6.el8 | < 0:1.9.0-102.el8
Alpine1 product
  • gitlab-runner< 15.10.0-r0
Debian1 product
  • golang-github-emicklei-go-restful< 3.10.2-1
Emicklei1 product
Fedoraproject1 product
Github.com/emicklei1 product
  • go-restful< 2.16.0 | < 2.16.0+incompatible
Go-restful_project1 product
Ubuntu1 product
  • golang-github-emicklei-go-restfulAll versions (No fix recorded)

13 vendors · 118 products

References

49 links
Show all 49 references