CVE-2022-22975 - An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources

Back Back to CVE browser

MEDIUM

An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources

Published May 11, 2022

6.6

MEDIUM

CVSS 3.1

EPSS 0.99%

Description

An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name (CN) of their user entry on the LDAP or AD server to include special characters, which could be used to perform LDAP query injection on the Supervisor's LDAP query which determines their Kubernetes group membership.

Affected products

Vendor n/a Product Pinniped Default
n/a
- Version
  Pinniped versions before v0.17.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Pinniped

n/a

Version	Status	Constraints
Pinniped versions before v0.17.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-74

References (1)

https://github.com/vmware-tanzu/pinniped/security/advisories/GHSA-hvrf-5hhv-4348
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://github.com/vmware-tanzu/pinniped/security/advisories/GHSA-hvrf-5hhv-4348		x_refsource_MISCThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner vmware

Published May 11, 2022

Updated Aug 3, 2024

Reserved Jan 10, 2022

Link CVE-2022-22975

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-22975

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-22975