CVE-2022-37968

Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-37968	Patch Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-37968	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.5.8:::::::*
	cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.6.19:::::::*
	cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.7.18:::::::*
	cpe:2.3:a:microsoft:azure_arc-enabled_kubernetes:1.8.11:::::::*
	cpe:2.3:a:microsoft:azure_stack_edge:-:::::::*

History

21 Nov 2024, 07:15

Type	Values Removed	Values Added
References	~~() https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-37968 - Patch, Vendor Advisory~~	() https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-37968 - Patch, Vendor Advisory

29 May 2024, 14:15

Type	Values Removed	Values Added
Summary	(en) <p>Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.</p>	(en) Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.

20 Dec 2023, 20:15

Type	Values Removed	Values Added
Summary	~~Azure Arc-enabled Kubernetes cluster Connect Elevation of Privilege Vulnerability.~~	<p>Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.</p>

08 Aug 2023, 14:22

Type	Values Removed	Values Added
CWE	~~CWE-269~~	NVD-CWE-noinfo

Information

Published : 2022-10-11 19:15

Updated : 2024-11-21 07:15

NVD link : CVE-2022-37968

Mitre link : CVE-2022-37968

CVE.ORG link : CVE-2022-37968

JSON object : View

Products Affected

microsoft

azure_stack_edge
azure_arc-enabled_kubernetes

CWE

NVD-CWE-noinfo

10.0 /10