CVE-2022-3841

RHACM: unauthenticated SSRF in console API endpoint

Published Jan 11, 2023 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
RHACM: unauthenticated SSRF in console API endpoint. A Server-Side Request Forgery (SSRF) vulnerability was found in the console API endpoint from Red Hat Advanced Cluster Management for Kubernetes (RHACM). An attacker could take advantage of this as the console API endpoint is missing an authentication check, allowing unauthenticated users making requests.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-43181 RHACM: unauthenticated SSRF in console API endpoint. A Server-Side Request Forgery (SSRF) vulnerability was found in the console API endpoint from Red Hat Advanced Cluster Management for Kubernetes (RHACM). An attacker could take advantage of this as the console API endpoint is missing an authentication check, allowing unauthenticated users making requests.
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.6::el8
Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.6::el8
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Apr 9, 2025, 1:39 PM
Reserved
Nov 2, 2022, 4:25 PM
Status
Modified
Published
Jan 13, 2023, 6:15 AM
Modified
Jun 17, 2026, 5:00 AM
Severity
Moderate
Public date
Nov 2, 2022, 12:00 AM