{"id":"CVE-2022-30535","aliases":["BIT-nginx-ingress-controller-2022-30535","EUVD-2022-52395","GHSA-cmrv-mf45-jw6v"],"status":"published","title":"NGINX Ingress Controller vulnerability CVE-2022-30535","description":"In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00714,"percentile":0.53978,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2022-08-04T17:45:41Z","modified":"2026-07-09T04:31:46Z","fixes":[{"ecosystem":"Bitnami","package":"nginx-ingress-controller","fixed_in":["2.3.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"nginx-ingress-controller","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"2.3.0"}]}]}],"products":[{"vendor":"f5","product":"nginx ingress controller"},{"vendor":"f5","product":"nginx_ingress_controller"}],"references":[{"url":"https://support.f5.com/csp/article/K52125139","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30535"},{"url":"https://github.com/advisories/GHSA-cmrv-mf45-jw6v"}],"sources":{"cve":[{"id":"CVE-2022-30535","title":"NGINX Ingress Controller vulnerability CVE-2022-30535","description":"In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2022-08-04T17:45:41.852Z","modified":"2024-09-16T20:07:20.068Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:30.842561Z"}],"euvd":[{"id":"EUVD-2022-52395","description":"In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2022-08-04T17:45:41Z","modified":"2024-09-16T20:07:20Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:55:16.813871Z"}],"ghsa":[{"id":"GHSA-cmrv-mf45-jw6v","title":"In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update...","description":"In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2022-08-05T00:00:24Z","modified":"2023-01-30T05:01:00Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:46:19.140142Z"}],"nvd":[{"id":"CVE-2022-30535","description":"In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2022-08-04T18:15:09.423Z","modified":"2026-06-17T04:43:49.04Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:24.39467Z"}],"osv":[{"id":"CVE-2022-30535","description":"In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2022-08-04T18:15:09.423Z","modified":"2026-07-09T04:31:46.933901Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"BIT-nginx-ingress-controller-2022-30535","description":"In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2023-11-06T08:57:20.681Z","modified":"2023-12-06T01:02:16.295972Z","updated_at":"2026-11-02T15:28:34.007508Z"}]}}