How severe is CVE-2022-23551?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 5.3 out of 10.

What type of vulnerability is CVE-2022-23551?

This is classified as CWE-863, which is a common weakness in software security.

CVE-2022-23551 - MEDIUM Severity | CVSS 5.3

Vulnerability Description

aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request (example: `/metadata/identity\oauth2\token/`) would bypass the NMI validation and be sent to IMDS allowing a pod in the cluster to access identities that it shouldn't have access to. This issue has been fixed and has been included in AAD Pod Identity release version 1.8.13. If using the AKS pod-managed identities add-on, no action is required. The clusters should now be running the version 1.8.13 release.

Related Vulnerabilities

CVE-2016-10996

MEDIUM

CVSS:5.3(Medium)

The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.

CWE-8632016

CVE-2017-18095

MEDIUM

CVSS:5.3(Medium)

The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to a...

CWE-8632017

CVE-2018-1000110

MEDIUM

CVSS:5.3(Medium)

An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users.

CWE-8632018

CVE-2018-1000111

MEDIUM

CVSS:5.3(Medium)

An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and SubversionRepositoryStatus.java that allows an attacker with network...

CWE-8632018

CVE-2018-1000112

MEDIUM

CVSS:5.3(Medium)

An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an attacker with network access to obtain a list of nodes and use...

CWE-8632018

CVE-2018-18819

MEDIUM

CVSS:5.3(Medium)

A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202), and MiVoice Business Express versions 7....

CWE-8632018