{"api_version":"1","generated_at":"2026-04-23T06:20:16+00:00","cve":"CVE-2022-3172","urls":{"html":"https://cve.report/CVE-2022-3172","api":"https://cve.report/api/cve/CVE-2022-3172.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-3172","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-3172"},"summary":{"title":"CVE-2022-3172","description":"A security issue was discovered in kube-apiserver that allows an \naggregated API server to redirect client traffic to any URL.  This could\n lead to the client performing unexpected actions as well as forwarding \nthe client's API server credentials to third parties.","state":"PUBLIC","assigner":"security@kubernetes.io","published_at":"2023-11-03 20:15:00","updated_at":"2023-12-21 22:15:00"},"problem_types":["CWE-918"],"metrics":[],"references":[{"url":"https://security.netapp.com/advisory/ntap-20231221-0005/","name":"https://security.netapp.com/advisory/ntap-20231221-0005/","refsource":"","tags":[],"title":"CVE-2022-3172 Kubernetes Vulnerability in NetApp Products | NetApp Product Security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak","name":"https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak","refsource":"MISC","tags":[],"title":"[Security Advisory] CVE-2022-3172: Aggregated API server can cause clients to be redirected (SSRF)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/kubernetes/kubernetes/issues/112513","name":"https://github.com/kubernetes/kubernetes/issues/112513","refsource":"MISC","tags":[],"title":"CVE-2022-3172: Aggregated API server can cause clients to be redirected (SSRF) · Issue #112513 · kubernetes/kubernetes · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3172","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3172","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"3172","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kubernetes","cpe5":"apiserver","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"3172","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kubernetes","cpe5":"apiserver","cpe6":"1.25.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"3172","vulnerable":"1","versionEndIncluding":"1.21.14","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"kubernetes","cpe5":"apiserver","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-3172","qid":"160120","title":"Oracle Enterprise Linux Security Update for kubernetes (ELSA-2022-9856)"},{"cve":"CVE-2022-3172","qid":"160121","title":"Oracle Enterprise Linux Security Update for kubernetes (ELSA-2022-9855)"},{"cve":"CVE-2022-3172","qid":"160127","title":"Oracle Enterprise Linux Security Update for kubernetes (ELSA-2022-9853)"},{"cve":"CVE-2022-3172","qid":"160128","title":"Oracle Enterprise Linux Security Update for kubernetes (ELSA-2022-9854)"},{"cve":"CVE-2022-3172","qid":"181090","title":"Debian Security Update for kubernetes (CVE-2022-3172)"},{"cve":"CVE-2022-3172","qid":"241070","title":"Red Hat OpenShift Container Platform 4.12 Security Update (RHSA-2022:7398)"},{"cve":"CVE-2022-3172","qid":"241340","title":"Red Hat OpenShift Container Platform 4.10 Security Update (RHSA-2023:1655)"},{"cve":"CVE-2022-3172","qid":"770172","title":"Red Hat OpenShift Container Platform 4.12 Security Update (RHSA-2022:7398)"},{"cve":"CVE-2022-3172","qid":"770184","title":"Red Hat OpenShift Container Platform 4.10 Security Update (RHSA-2023:1655)"}]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2022-3172","ASSIGNER":"security@kubernetes.io","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"A security issue was discovered in kube-apiserver that allows an \naggregated API server to redirect client traffic to any URL.  This could\n lead to the client performing unexpected actions as well as forwarding \nthe client's API server credentials to third parties.\n"}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-918 Server-Side Request Forgery (SSRF)","cweId":"CWE-918"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Kubernetes","product":{"product_data":[{"product_name":"kube-apiserver","version":{"version_data":[{"version_value":"not down converted","x_cve_json_5_version_data":{"versions":[{"status":"affected","version":"v1.25.0"},{"lessThanOrEqual":"v1.24.4","status":"affected","version":"v1.24.0","versionType":"semver"},{"lessThanOrEqual":"v1.23.10","status":"affected","version":"v1.23.0","versionType":"semver"},{"lessThanOrEqual":"v1.22.13","status":"affected","version":"v1.22.0","versionType":"semver"},{"status":"unaffected","version":"v1.25.1"},{"status":"unaffected","version":"v1.24.5"},{"status":"unaffected","version":"v1.23.11"},{"status":"unaffected","version":"v1.22.14"},{"lessThanOrEqual":"v1.21.14","status":"affected","version":"0","versionType":"semver"}],"defaultStatus":"unaffected"}}]}}]}}]}},"references":{"reference_data":[{"url":"https://github.com/kubernetes/kubernetes/issues/112513","refsource":"MISC","name":"https://github.com/kubernetes/kubernetes/issues/112513"},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak","refsource":"MISC","name":"https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak"}]},"generator":{"engine":"Vulnogram 0.1.0-dev"},"source":{"discovery":"EXTERNAL"},"credits":[{"lang":"en","value":"Nicolas Joly"},{"lang":"en","value":"Weinong Wang"}],"impact":{"cvss":[{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L","version":"3.1"}]}},"nvd":{"publishedDate":"2023-11-03 20:15:00","lastModifiedDate":"2023-12-21 22:15:00","problem_types":["CWE-918"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.7}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*","versionEndIncluding":"1.21.14","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*","versionStartIncluding":"1.22.0","versionEndExcluding":"1.22.14","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*","versionStartIncluding":"1.23.0","versionEndExcluding":"1.23.11","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*","versionStartIncluding":"1.24.0","versionEndExcluding":"1.24.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:kubernetes:apiserver:1.25.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}