CVE-2022-37968
Azure Arc-enabled Kubernetes cluster Connect Elevation of Privilege Vulnerability
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.8.11, 1.7.18, 1.5.8, 1.6.19, 2.2.2088.5593
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.
Timeline
- CVE published
- Record last updated
Affected versions
- Microsoft Azure Arc-enabled Kubernetes cluster 1.8.11
From 1.0.0 · fixed in 1.8.11
- Microsoft Azure Arc-enabled Kubernetes cluster 1.7.18
From 1.0.0 · fixed in 1.7.18
- Microsoft Azure Arc-enabled Kubernetes cluster 1.5.8
From 1.0.0 · fixed in 1.5.8
- Microsoft Azure Arc-enabled Kubernetes cluster 1.6.19
From 1.0.0 · fixed in 1.6.19
- Microsoft Azure Stack Edge
From 2.2.0 · fixed in 2.2.2088.5593