1. Home
  2. CVE Database
  3. CVE-2022-30535
MEDIUM · 6.5

CVE-2022-30535

In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versio...

Vulnerability Description

In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
F5Nginx Ingress Controller>= 1.0.0, < 2.3.0

Related Weaknesses (CWE)

CWE-20

References

FAQ

What is CVE-2022-30535?

CVE-2022-30535 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versio...

How severe is CVE-2022-30535?

CVE-2022-30535 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-30535?

Check the references section above for vendor advisories and patch information. Affected products include: F5 Nginx Ingress Controller.