CVE-2022-2837
EUVD-2023-102703.03.2023, 16:15
A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for external top-level domains (TLD) to a pod they control by creating projects and namespaces that match the TLD.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| coredns.io | coredns | - |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-923 - Improper Restriction of Communication Channel to Intended EndpointsThe software establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.