CVE-2022-1902

highPriorität · verfolgen · 35EPSS 0.014 · 72. PerzentilEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.40% (72nd) EPSS
CVSS 8.8 · high
Is it mine?
27 products
Prüfe deine Angriffsfläche
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · bewertet 2026-10-27

A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobenadvanced-cluster-security/rhacs-main-rhel8@sha256:8ea2dd44cd9aee53482e36d88d57c0d352b27277c3c6a09973ad57499dc6c3d8_amd64 as a component of RHACS 3.68 for RHEL 8redhat_csaf

    If you are using the RHACS 3.68.1, you are advised to upgrade to patch release 3.68.2.

    https://access.redhat.com/errata/RHSA-2022:5132
  • Behobenadvanced-cluster-security/rhacs-main-rhel8@sha256:0c45ab080cd5f6429de49036fe846fe241c3044091dae245c2a6831cbdf20f65_amd64 as a component of RHACS 3.70 for RHEL 8redhat_csaf

    If you are using the RHACS 3.70.0, you are advised to upgrade to patch release 3.70.1.

    https://access.redhat.com/errata/RHSA-2022:5189
02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.8
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 5.9
v3.17.7highAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU
v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-200USCWE-497USCWE-497USCWE-668US
04

betroffene Produkte (27)

Betroffene Produkte und Versionsbereiche.

20 von 27 angezeigt
05

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

  • RHSA-2022:5132Red Hat Security Advisory: RHACS 3.68 security update2022-06-20csaf · redhat_csafUS

    Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes (RHACS). The updated image includes bug and security fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2022:5189Red Hat Security Advisory: RHACS 3.70 security update2022-06-27csaf · redhat_csafUS

    Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes (RHACS). The updated image includes bug and security fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

06

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bdunvdredhat_csafNVDCVE.orgMITRE
veröffentlicht 2022-09-01geändert 2026-06-17
08

Referenzen (19)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan