A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges.
References
Link | Resource |
---|---|
https://access.redhat.com/security/cve/CVE-2022-1902 | Vendor Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=2090957 | Issue Tracking Vendor Advisory |
https://github.com/stackrox/stackrox/pull/1803 | Exploit Patch Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: redhat
Published: 2022-09-01T19:54:44
Updated: 2022-09-01T19:54:44
Reserved: 2022-05-27T00:00:00
Link: CVE-2022-1902
JSON object: View
NVD Information
Status : Modified
Published: 2022-09-01T21:15:09.110
Modified: 2023-02-12T22:15:24.413
Link: CVE-2022-1902
JSON object: View
Redhat Information
No data.