CVE-2022-3172 MEDIUM

CVE-2022-3172: Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)

Vendor Kubernetes
Product kube-apiserver
Weakness CWE-918 · SSRF
Published November 3, 2023
Last update February 13, 2025
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.

Key dates

02Disclosure timeline

November 3, 2023 CVE published
February 13, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-35635 WordPress Ninja Tables plugin <= 5.0.9 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-10583 nextlevelbuilder GoClaw TTS Configuration Endpoint tts_config.go import server-side request forgery CVE-2026-10546 DNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL Component CVE-2024-47208 Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE CVE-2022-2556 MailChimp for Woocommerce < 2.7.2 - Admin+ SSRF