CVE-2022-30535: NGINX Ingress Controller vulnerability CVE-2022-30535
In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-30535?
CVE-2022-30535 is a vulnerability that allows an attacker authorized to create or update ingress objects to obtain secrets available to the NGINX Ingress Controller in versions 2.x before 2.3.0 and all versions of 1.x.
How severe is CVE-2022-30535?
CVE-2022-30535 has a severity value of 6.5, which is considered medium.
Which software versions are affected by CVE-2022-30535?
Versions 2.x before 2.3.0 and all versions of 1.x of the NGINX Ingress Controller are affected by CVE-2022-30535.
How can an attacker exploit CVE-2022-30535?
An attacker authorized to create or update ingress objects can exploit CVE-2022-30535 to obtain the secrets available to the NGINX Ingress Controller.
Is there a fix available for CVE-2022-30535?
To fix CVE-2022-30535, it is recommended to update to version 2.3.0 or later of the NGINX Ingress Controller.