Riskcovery

CVE-2022-37968

Azure Arc-enabled Kubernetes cluster Connect Elevation of Privilege Vulnerability

State
Published
Severity
10.0 Critical
Published
Oct 11, 2022
Updated
Jan 2, 2025
Reserved
Aug 8, 2022

Read the record on cve.org

Description

Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.

Scores

CVSSScoreVectorSource
3.110.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:Cmicrosoft

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
Azure Arc-enabled Kubernetes cluster 1.8.11Microsoft
  • 1.0.0 to before 1.8.11Affected
Azure Arc-enabled Kubernetes cluster 1.7.18Microsoft
  • 1.0.0 to before 1.7.18Affected
Azure Arc-enabled Kubernetes cluster 1.5.8Microsoft
  • 1.0.0 to before 1.5.8Affected
Azure Arc-enabled Kubernetes cluster 1.6.19Microsoft
  • 1.0.0 to before 1.6.19Affected
Azure Stack EdgeMicrosoft
  • 2.2.0 to before 2.2.2088.5593Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.