Strix
26.1K

CVE-2022-37968

CRITICALCVSS 10/10EPSS 2.59%

Last modified

CVE-2022-37968 is a critical-severity vulnerability rated 10/10 on the CVSS scale. Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. EPSS estimates a 2.59% chance of exploitation in the next 30 days.

Description

Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.

Metrics

CVSS 3.1
10/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Probability
2.59%

83.3th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
MicrosoftAzure Arc-Enabled Kubernetes1.5.8
MicrosoftAzure Arc-Enabled Kubernetes1.6.19
MicrosoftAzure Arc-Enabled Kubernetes1.7.18
MicrosoftAzure Arc-Enabled Kubernetes1.8.11
MicrosoftAzure Stack EdgeAll versions

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-37968?
Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.
How severe is CVE-2022-37968?
CVE-2022-37968 has a CVSS score of 10/10 (CRITICAL severity). The EPSS model estimates a 2.59% probability of exploitation in the next 30 days.
How do I fix CVE-2022-37968?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-37968?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST