CVE-2022-1902 Information disclosure in Red Hat Advanced Cluster Security for Kubernetes
Authenticated users can retrieve unsanitized notifier secrets via the GraphQL API, leading to information disclosure and potential privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1902?
CVE-2022-1902 is a high-severity vulnerability in Red Hat Advanced Cluster Security for Kubernetes, published on 1 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges.
Which versions are affected by CVE-2022-1902?
It affects 1 product.
Products include Redhat Advanced Cluster Security.
How do I fix CVE-2022-1902?
No fix has been published for CVE-2022-1902 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-1902 being exploited?
There is no known exploitation of CVE-2022-1902 in the wild and no public exploit code.
Other vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes
Sources
Also known as GHSA-c2p8-xm7c-wc48.