CVE-2022-30535 NGINX Ingress Controller vulnerability CVE-2022-30535

2022-08-0417:45:41

CWE-20

www.cve.org

cve-2022-30535

nginx ingress controller

version 2.3.0

version 1.x

authorized attacker

secrets access

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

27.5%

JSON

In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CNA Affected

[
  {
    "product": "NGINX Ingress Controller",
    "vendor": "F5",
    "versions": [
      {
        "lessThan": "2.3.0",
        "status": "affected",
        "version": "2.x",
        "versionType": "custom"
      },
      {
        "lessThan": "1.x*",
        "status": "affected",
        "version": "1.0.0",
        "versionType": "custom"
      }
    ]
  }
]