CVE-2022-37968 — CRITICAL (10.0)

Vulnerability Description

Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.

CVSS Score

10.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Microsoft	Azure Arc-Enabled Kubernetes	1.5.8
Microsoft	Azure Stack Edge	-

References

FAQ

What is CVE-2022-37968?

CVE-2022-37968 is a vulnerability with a CVSS score of 10.0 (CRITICAL). Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privile...

How severe is CVE-2022-37968?

CVE-2022-37968 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2022-37968?

Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Azure Arc-Enabled Kubernetes, Microsoft Azure Stack Edge.