CVE-2022-43915

IBM App Connect Enterprise Certified Container 5.0, 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, and 12.1 does not limit calls to unshare in running Pods.  This can allow a user with privileged access to execute commands in a running Pod to elevate their user privileges.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
ibmCNA
6.8 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
VendorProductVersion
ibmapp_connect_enterprise_certified_container
5.0
ibmapp_connect_enterprise_certified_container
7.1
ibmapp_connect_enterprise_certified_container
7.2
ibmapp_connect_enterprise_certified_container
8.0
ibmapp_connect_enterprise_certified_container
8.1
ibmapp_connect_enterprise_certified_container
8.2
ibmapp_connect_enterprise_certified_container
9.0
ibmapp_connect_enterprise_certified_container
9.1
ibmapp_connect_enterprise_certified_container
9.2
ibmapp_connect_enterprise_certified_container
10.0
ibmapp_connect_enterprise_certified_container
10.1
ibmapp_connect_enterprise_certified_container
11.0
ibmapp_connect_enterprise_certified_container
11.1
ibmapp_connect_enterprise_certified_container
11.2
ibmapp_connect_enterprise_certified_container
11.3
ibmapp_connect_enterprise_certified_container
11.4
ibmapp_connect_enterprise_certified_container
11.5
ibmapp_connect_enterprise_certified_container
11.6
ibmapp_connect_enterprise_certified_container
12.0
ibmapp_connect_enterprise_certified_container
12.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://exchange.xforce.ibmcloud.com/vulnerabilities/241037
https://www.ibm.com/support/pages/node/7166463