Scribd
Upload
12 views

NVD - CVE-2022-2837

CVE-2022-2837 describes a vulnerability in coreDNS that allows malicious users to redirect traffic for external top-level domains to controlled pods. The CVSS base score for this vulnerability is 6.1, indicating a medium severity level. The document includes references to advisories and tools for mitigation, as well as details on affected software configurations.

Uploaded by

vinaybhadeshiya6
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
12 views

NVD - CVE-2022-2837

CVE-2022-2837 describes a vulnerability in coreDNS that allows malicious users to redirect traffic for external top-level domains to controlled pods. The CVSS base score for this vulnerability is 6.1, indicating a medium severity level. The document includes references to advisories and tools for mitigation, as well as details on affected software configurations.

Uploaded by

vinaybhadeshiya6
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 3

An official website of the United States government Here's how you know

NVD

VULNERABILITIES

CVE-2022-2837 Detail
MODIFIED

This CVE record has been updated after NVD enrichment efforts were completed. Enrichment

data supplied by the NVD may require amendment due to these changes.

Description
A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for

external top-level domains (TLD) to a pod they control by creating projects and namespaces that

match the TLD.

Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information

contributed by other sources is also displayed.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score: 6.1 MEDIUM

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References to Advisories, Solutions, and Tools


By selecting these links, you will be leaving NIST webspace. We have provided these links to other

web sites because they may have information that would be of interest to you. No inferences should

be drawn on account of other sites being referenced, or not, from this page. There may be other web

sites that are more appropriate for your purpose. NIST does not necessarily endorse the views

expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any

commercial products that may be mentioned on these sites. Please address comments about this

page to [email protected].

Hyperlink Resource

https://bugzilla.redhat.com/show_bug.cgi? Issue Tracking Mitigation Third Party Advisory

id=2118543

https://bugzilla.redhat.com/show_bug.cgi? Issue Tracking Mitigation Third Party Advisory

id=2118543
Weakness Enumeration
CWE-ID CWE Name Source

CWE-601 URL Redirection to Untrusted Site ('Open Redirect') NIST

CWE-923 Improper Restriction of Communication Channel to Intended Endpoints Red Hat, Inc.

Known Affected Software Configurations Switch to CPE 2.2


Configuration 1 ( hide )

cpe:2.3:a:coredns.io:coredns:-:*:*:*:*:*:*:*

Show Matching CPE(s)

 Denotes Vulnerable Software

Are we missing a CPE here? Please let us know.

Change History
3 change records found show changes

QUICK INFO

CVE Dictionary Entry:

CVE-2022-2837      
NVD Published Date:

03/03/2023

NVD Last Modified:

11/21/2024

Source:
HEADQUARTERS
100 Bureau Drive
Red Hat, Inc.
Gaithersburg, MD 20899
(301) 975-2000

Webmaster | Contact Us | Our Other Offices


Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email: [email protected]
Phone: 1-888-282-0870

Site Privacy | Accessibility | Privacy Program | Copyrights | Vulnerability Disclosure | No Fear Act Policy | FOIA | Environmental
Policy | Scientific Integrity | Information Quality Standards | Commerce.gov | Science.gov | USA.gov

You might also like