Vulnerabilities
Misconfiguration
Runtime Security
Compliance
CVE Vulnerabilities

CVE-2022-0144

Improper Privilege Management

Published: Jan 11, 2022 | Modified: Feb 09, 2022
CVSS 3.x
7.1
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 2.x
3.6 LOW
AV:L/AC:L/Au:N/C:P/I:N/A:P
RedHat/V2
RedHat/V3
7.1 MODERATE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Ubuntu
MEDIUM
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2022-0144
CWEhttps://cwe.mitre.org/data/definitions/269.html

shelljs is vulnerable to Improper Privilege Management

Weakness

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Software

Name Vendor Start Version End Version
Shelljs Shelljs_project * 0.8.5 (excluding)
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-grafana-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-must-gather-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-operator-bundle-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat application-ui-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat assisted-image-service-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat cert-policy-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat cluster-backup-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat clusterclaims-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat cluster-curator-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat clusterlifecycle-state-metrics-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat cluster-proxy-addon-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat config-policy-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat console-api-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat console-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat discovery-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat endpoint-monitoring-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-propagator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-spec-sync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-status-sync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-template-sync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat grafana-dashboard-loader-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat grc-ui-api-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat grc-ui-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat iam-policy-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat insights-client-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat insights-metrics-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat klusterlet-addon-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat klusterlet-addon-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat kube-rbac-proxy-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat kube-state-metrics-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat managedcluster-import-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat management-ingress-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat memcached-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat memcached-exporter-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat metrics-collector-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicloud-integrations-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicloud-manager-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multiclusterhub-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multiclusterhub-repo-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-observability-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-application-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-channel-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-deployable-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-placementrule-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-subscription-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-subscription-release-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat node-exporter-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat observatorium-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat observatorium-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat openshift-hive-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat placement-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat prometheus-alertmanager-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat prometheus-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat provider-credential-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat rbac-query-proxy-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat redisgraph-tls-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat registration-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat registration-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat rhacm-agent-service-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat rhacm-assisted-installer-agent-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat rhacm-assisted-installer-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat rhacm-assisted-installer-reporter-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-aggregator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-api-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-collector-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-ui-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat submariner-addon-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat thanos-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat thanos-receive-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat volsync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat volsync-mover-rclone-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat volsync-mover-restic-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat volsync-mover-rsync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat work-container *
Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 RedHat rhacm2/console-rhel8:v2.3.8-4 *
Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8 RedHat rhacm2/search-ui-rhel8:v2.3.8-4 *
Node-shelljs Ubuntu bionic *
Node-shelljs Ubuntu hirsute *
Node-shelljs Ubuntu impish *
Node-shelljs Ubuntu trusty *
Node-shelljs Ubuntu upstream *
Node-shelljs Ubuntu xenial *

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2024 Aqua Security Software Ltd.   Privacy Policy | Terms of Use