{"id":"CVE-2022-3172","summary":"Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)","details":"A security issue was discovered in kube-apiserver that allows an \naggregated API server to redirect client traffic to any URL.  This could\n lead to the client performing unexpected actions as well as forwarding \nthe client's API server credentials to third parties.","modified":"2026-08-12T03:51:30.477872602Z","published":"2023-11-03T18:11:53.835Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3172.json","cna_assigner":"kubernetes","cwe_ids":["CWE-918"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3172.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3172"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20231221-0005/"},{"type":"REPORT","url":"https://github.com/kubernetes/kubernetes/issues/112513"},{"type":"PACKAGE","url":"https://github.com/kubernetes/kubernetes"},{"type":"ARTICLE","url":"https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kubernetes/apiserver","events":[{"introduced":"0"},{"last_affected":"4014bbb2a778f75173c6613e5e97aabf746a403d"},{"introduced":"3b761878e82bcbbfa3b462afd87651ada147b10c"},{"fixed":"81834bef33d52c0274ed187af33d8fdf7ae28f43"},{"introduced":"5dc525b156d2bb030a37924dc0acf1ac1c2f1da3"},{"fixed":"778eede58b18cc538a84cf48a2c967a71a84f9e1"},{"introduced":"a2c383e26aa8fce62b048d347bd4ad5d07fddab0"},{"fixed":"d43bcd693c0c14de0281f7e4f300200654ed48a2"},{"introduced":"456c5a07f9118d0118129d0f80eb5b586b3d151f"},{"last_affected":"456c5a07f9118d0118129d0f80eb5b586b3d151f"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"1.21.14"},{"introduced":"1.22.0"},{"fixed":"1.22.14"},{"introduced":"1.23.0"},{"fixed":"1.23.11"},{"introduced":"1.24.0"},{"fixed":"1.24.5"},{"introduced":"1.25.0"},{"last_affected":"1.25.0"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*","cpe:2.3:a:kubernetes:apiserver:1.25.0:*:*:*:*:*:*:*"]}},{"type":"GIT","repo":"https://github.com/kubernetes/kubernetes","events":[{"introduced":"0"},{"last_affected":"0f77da5bd4809927e15d1658fb4aa8f13ad890a5"},{"introduced":"c2b5237ccd9c0f1d600d3072634ca66cefdf272f"},{"fixed":"bccf857df03c5a99a35e34020b3b63055f0c12ec"},{"introduced":"ab69524f795c42094a6630298ff53f3c3ebab7f4"},{"fixed":"dc2898b20c6bd9602ae1c3b51333e2e4640ed249"},{"introduced":"4ce5a8954017644c5420bae81d72b09b735c21f0"},{"fixed":"e979822c185a14537054f15808a118d7fcce1d6e"},{"introduced":"a866cbe2e5bbaa01cfd5e969aa3e033f3282a8a2"},{"last_affected":"a866cbe2e5bbaa01cfd5e969aa3e033f3282a8a2"}],"database_specific":{"cpe":["cpe:2.3:a:kubernetes:apiserver:*:*:*:*:*:*:*:*","cpe:2.3:a:kubernetes:apiserver:1.25.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"1.21.14"},{"introduced":"1.22.0"},{"fixed":"1.22.14"},{"introduced":"1.23.0"},{"fixed":"1.23.11"},{"introduced":"1.24.0"},{"fixed":"1.24.5"},{"introduced":"1.25.0"},{"last_affected":"1.25.0"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["1.25.0","v1.25.0","v0.25.0","kubernetes-1.25.0","v0.21.14","kubernetes-1.21.14","kubernetes-1.14.0-alpha.0","kubernetes-1.10.0-alpha.3","kubernetes-1.10.0-alpha.2","kubernetes-1.10.0-alpha.1","kubernetes-1.9.0-beta.0","kubernetes-1.10.0-alpha.0","kubernetes-1.9.0-alpha.3","kubernetes-1.9.0-alpha.2","kubernetes-1.9.0-alpha.1","kubernetes-1.9.0-alpha.0","kubernetes-1.8.0-beta.0","v1.24.5-rc.0","v1.23.11-rc.0","v1.22.14-rc.0","v1.24.4","v1.23.10","v1.22.13","v1.22.13-rc.0","v1.24.4-rc.0","v1.23.10-rc.0","v1.22.12","v1.24.3","v1.23.9","v1.23.9-rc.0","v1.22.12-rc.0","v1.23.8","v1.22.11","v1.24.3-rc.0","v1.24.2","v1.21.14","v1.22.11-rc.0","v1.21.14-rc.0","v1.23.8-rc.0","v1.24.2-rc.0","v1.22.10","v1.21.13","v1.23.7","v1.24.1","v1.24.1-rc.0","v1.24.0","v1.23.7-rc.0","v1.23.6","v1.22.10-rc.0","v1.22.9","v1.21.13-rc.0","v1.21.12","v1.23.6-rc.0","v1.23.5","v1.22.9-rc.0","v1.21.12-rc.0","v1.22.8","v1.21.11","v1.23.5-rc.0","v1.22.8-rc.0","v1.23.4","v1.21.11-rc.0","v1.22.7","v1.21.10","v1.23.4-rc.0","v1.23.3","v1.21.10-rc.0","v1.23.3-rc.0","v1.22.7-rc.0","v1.21.9","v1.23.2","v1.22.6","v1.23.2-rc.0","v1.23.1","v1.22.6-rc.0","v1.22.5","v1.21.9-rc.0","v1.21.8","v1.23.1-rc.0","v1.23.0","v1.22.5-rc.0","v1.22.4","v1.21.8-rc.0","v1.21.7","v1.22.4-rc.0","v1.22.3","v1.21.7-rc.0","v1.21.6","v1.22.3-rc.0","v1.21.6-rc.0","v1.22.2","v1.21.5","v1.22.2-rc.0","v1.22.1","v1.21.5-rc.0","v1.21.4","v1.22.1-rc.0","v1.22.0","v1.21.4-rc.0","v1.21.3","v1.21.3-rc.0","v1.21.2","v1.21.2-rc.0","v1.21.1","v1.21.1-rc.0","v1.21.0","v1.21.0-rc.0","v1.22.0-alpha.0","v1.21.0-beta.1","v1.21.0-beta.0","v1.21.0-alpha.3","v1.21.0-alpha.2","v1.21.0-alpha.1","v1.21.0-alpha.0","v1.20.0-beta.2","v1.20.0-beta.1","v1.20.0-beta.0","v1.20.0-alpha.3","v1.20.0-alpha.2","v1.20.0-alpha.1","v1.20.0-alpha.0","v1.19.0-beta.2","v1.19.0-beta.1","v1.19.0-beta.0","v1.19.0-alpha.3","v1.19.0-alpha.2","v1.19.0-alpha.1","v1.19.0-alpha.0","v1.18.0-alpha.5","v1.18.0-alpha.4","v1.18.0-alpha.2","v1.18.0-alpha.1","v1.18.0-alpha.0","v1.17.0-alpha.3","v1.17.0-alpha.1","v1.17.0-alpha.2","v1.17.0-alpha.0","v1.16.0-alpha.3","v1.16.0-alpha.2","v1.16.0-alpha.1","v1.16.0-alpha.0","v1.15.0-alpha.3","v1.15.0-alpha.2","v1.15.0-alpha.1","v1.14.0-alpha.3","v1.15.0-alpha.0","v1.14.0-alpha.2","v1.14.0-alpha.1","v1.14.0-alpha.0","v1.13.0-alpha.3","v1.13.0-alpha.2","v1.13.0-alpha.1","v1.13.0-alpha.0","v1.12.0-alpha.1","v1.12.0-alpha.0","v1.11.0-alpha.2","v1.11.0-alpha.1","v1.11.0-alpha.0","v1.10.0-alpha.3","v1.10.0-alpha.2","v1.10.0-alpha.1","v1.9.0-alpha.3","v1.10.0-alpha.0","v1.9.0-alpha.2","v1.9.0-alpha.1","v1.9.0-alpha.0","v1.8.0-alpha.3","v1.8.0-alpha.2","v1.8.0-alpha.0","v1.8.0-alpha.1","v1.7.0-alpha.4","v1.7.0-alpha.3","v1.7.0-alpha.2","v1.7.0-alpha.1","v1.7.0-alpha.0","v1.6.0-alpha.3","v1.6.0-alpha.2","v1.6.0-alpha.1","v1.6.0-alpha.0","v1.5.0-alpha.2","v1.5.0-alpha.1","v1.5.0-alpha.0","v1.4.0-alpha.3","v1.4.0-alpha.1","v1.4.0-alpha.2","v1.3.0-alpha.5","v1.3.0-alpha.4","v1.3.0-alpha.3","v1.3.0-alpha.1","v1.3.0-alpha.2","v1.3.0-alpha.0","v1.2.0-alpha.8","v1.2.0-alpha.7","v1.2.0-alpha.6","v1.2.0-alpha.5","v1.2.0-alpha.4","v1.2.0-alpha.3","v1.2.0-alpha.2","v1.2.0-alpha.1","v1.1.0-alpha.1","v1.1.0-alpha.0","v0.17.0","v0.13.1-dev"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-3172.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L"}]}