CVE-2022-22975

Published: May 11, 2022Modified: Jun 17, 2026

6.6

Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.7 / Impact: 5.9

Source: NVD

Description

An issue was discovered in the Pinniped Supervisor with either LADPIdentityProvider or ActiveDirectoryIdentityProvider resources. An attack would involve the malicious user changing the common name (CN) of their user entry on the LDAP or AD server to include special characters, which could be used to perform LDAP query injection on the Supervisor's LDAP query which determines their Kubernetes group membership.

Affected (1)

Products: Vmware: Pinniped

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vmware Pinniped	From 0.9.0 to 0.17.0

Related CWEs

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (2)

https://github.com/vmware-tanzu/pinniped/security/advisories/GHSA-hvrf-5hhv-4348

Source: security@vmware.com

Third Party Advisory

https://github.com/vmware-tanzu/pinniped/security/advisories/GHSA-hvrf-5hhv-4348

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.