VulnerabilityModified

CVE-2022-37968

Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters.

CRITICAL 10.0EPSS 2.53%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.53%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.

CVSS 3.1: 10.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS: 2.53% probability · 84th percentile
CISA KEV: Not listed
Affected: microsoft/azure arc-enabled kubernetes · microsoft/azure stack edge
Source: secure@microsoft.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.