coredns/coredns · Security
coreDNS vulnerable to Improper Restriction of Communication Channel to Intended Endpoints
- GHSA ID
- GHSA-h828-v5pv-33qx
- CVE ID
- CVE-2022-2837
- Severity
- medium
- Published
- Updated
- CVSS
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v3
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for external top-level domains (TLD) to a pod they control by creating projects and namespaces that match the TLD.
CWEs
- CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
- CWE-923 · Improper Restriction of Communication Channel to Intended Endpoints