Published: 06/05/2022 Updated: 02/12/2022

CVSS v2 Base Score: 5.5 | Impact Score: 4.9 | Exploitability Score: 8

CVSS v3 Base Score: 8.1 | Impact Score: 5.2 | Exploitability Score: 2.8

VMScore: 490

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N

A security issue exists in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

Vulnerable Product	Search on Vulmon	Subscribe to Product
kubernetes ingress-nginx

a user that can create or update ingress objects can use the `specrules[]httppaths[]path` field of an Ingress object (in the networkingk8sio` or `extensions` API group) to obtain the credentials of the ingress-nginx controller In the default configuration, that redential has access to all secrets in the cluster ...

CWE-20 https://github.com/kubernetes/ingress-nginx/issues/8502 https://groups.google.com/g/kubernetes-security-announce/c/7vQrpDZeBlc https://security.netapp.com/advisory/ntap-20220609-0006/https://nvd.nist.gov https://security.archlinux.org/CVE-2021-25745

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2021-25745

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect