CVE-2022-2385

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Kubernetes	aws-iam-authenticator	>= v0.5.2, < unspecified; >= unspecified, < v0.5.9

References

https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/472Issue Tracking, Third Party Advisory
https://groups.google.com/a/kubernetes.io/g/dev/c/EMxHpU-1ZYsIssue Tracking, Mailing List, Third Party Advisory
https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/472Issue Tracking, Third Party Advisory
https://groups.google.com/a/kubernetes.io/g/dev/c/EMxHpU-1ZYsIssue Tracking, Mailing List, Third Party Advisory

Timeline

Published: Jul 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-238507.8xhtml_translate_entity in xhtml.c in epub2txt (aka epub2txt2) through 2.02 allows a stack-based buffer overflow via a crafted EPUB document.CVE-2022-238519.8Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI).CVE-2022-238529.8Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.CVE-2022-238537.8The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP serve CVE-2022-238547.5AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user CVE-2022-238559.8An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An authentication bypass in ECM/maintenance/forgotpasswordstep CVE-2022-238565.3An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An attacker can enumerate users by changing the id parameter, CVE-2022-238576.5model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An aut CVE-2022-238588.8A flaw was found in the REST API. An improperly handled REST API call could allow any logged user to elevate privileges up to the system acc CVE-2022-23866.1The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, lead CVE-2022-238615.4Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web appl CVE-2022-238627.8A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JM