Lucene search

[email protected]CVE-2022-1798

HistorySep 15, 2022 - 4:15 p.m.

CVE-2022-1798

2022-09-1516:15:00

CWE-22

[email protected]

web.nvd.nist.gov

1917

cve-2022-1798

kubevirt

path traversal

vulnerability

nvd

security

filesystem

uid

gid

6.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

1.7 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

25.5%

JSON

A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.

VendorProductVersionCPE
googlegoogle\\-protobuf*cpe:2.3:a:google:google\\-protobuf:*:*:*:*:*:*:*:*
googlegoogle\\-protobuf*cpe:2.3:a:google:google\\-protobuf:*:*:*:*:*:*:*:*