QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2022-1798

Back to search

CVE-2022-1798

Published: Sep 15, 2022

Modified: Apr 21, 2025

PUBLISHED

CVSS v3.1

8.7

HIGH

Description

A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.

VendorProductVersions

Google LLC

Kubevirt

affected
unspecified - < 0.55.1
affected
unspecified - < 0.56.0

Weaknesses (CWE)

CWE-20

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

High

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now