Vulnerability · Published Sep 1, 2022 · Assigned by redhat
CVE-2022-2238
Medium 6.5
In plain English
A medium-severity SQL injection in Red Hat Advanced Cluster Management for Kubernetes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.9%top 39.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query in the search filter gets parsed by the backend. This flaw allows an attacker to craft specific strings containing special characters that lead to crashing the pod and affects system availability while restarting.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Red Hat Advanced Cluster Management for Kubernetes | Red Hat Advanced Cluster Management for Kubernetes 2 |
Weakness: CWE-89
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2101669 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2022-2238 x_refsource_MISC