CVE-2022-30535 NGINX Ingress Controller vulnerability CVE-2022-30535
Authorized attackers can access secrets available to the NGINX Ingress Controller by creating or updating ingress objects.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-30535?
CVE-2022-30535 is a medium-severity vulnerability in F5 NGINX Ingress Controller, published on 4 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness: CWE-20
Which versions are affected by CVE-2022-30535?
1 open source package ship an affected version, including nginx-ingress-controller. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nginx-ingress-controller Bitnami | From 1.0.0 | 2.3.0 |
Products include F5 Nginx Ingress Controller.
How do I fix CVE-2022-30535?
Upgrade nginx-ingress-controller to 2.3.0 or later.
Is CVE-2022-30535 being exploited?
There is no known exploitation of CVE-2022-30535 in the wild and no public exploit code.
Other vulnerabilities in F5 NGINX Ingress Controller
Sources
Also known as BIT-nginx-ingress-controller-2022-30535, GHSA-cmrv-mf45-jw6v.