Auth bypass in Azure Aad-pod-identity
CVE-2022-23551
aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this…
EPSS: 0.008 (74.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L.
Affected products
- Azure Aad-pod-identity — versions < 1.8.13
Weakness classification (CWE)
References
- https://github.com/Azure/aad-pod-identity/security/advisories/GHSA-p82q-rxpm-hjpc (x_refsource_CONFIRM)
- https://github.com/Azure/aad-pod-identity/commit/7e01970391bde6c360d077066ca17d059204cb5d (x_refsource_MISC)
- https://github.com/Azure/aad-pod-identity/releases/tag/v1.8.13 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-23551?
- CVE-2022-23551 is a medium-severity vulnerability in Azure Aad-pod-identity, classified under CWE-1259. CVSS score: 5.3/10. Published 2022-12-21.
- How severe is CVE-2022-23551?
- Medium severity. CVSS v3 base score is 5.3 out of 10.