Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Cluster-monitoring-operator: credentials leak (cluster-monitoring-operator)

CVE-2024-1139
HIGH 7.7

En bref

Source
NVD
EPSS
EPSS 0.89 % · centile 59 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
redhat
Statut NVD
Deferred

Rechercher sur…

Description

A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.

Faiblesses (CWE)

  • CWE-200 — Exposition d'informations sensibles à un acteur non autorisé

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:Nredhat
CVSS 3.1HIGH 7.7CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NNVD · secalert@redhat.com (Secondary)

Avis

Références européennes

Produits affectés

ProduitVersions
cluster-monitoring-operatoraffected 0 ≤ 0.1.1
Red Hat · Red Hat OpenShift Container Platform 4.12unaffected v4.12.0-202405091536.p0.g8906207.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.13unaffected v4.13.0-202404200313.p0.gb518881.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.gf350a68.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.gcafed17.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.gafffdd4.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.ge79d817.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.ga0733c1.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.g1a5e72f.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.g2dbe78f.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.g46dedc6.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.gd8cf3c9.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.g46dedc6.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.gad85376.assembly.stream.el9 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.g8ba0b37.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404170009.p0.g3dc363d.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.g8853e6e.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.g27f105d.assembly.stream.el8 < *
Red Hat · Red Hat OpenShift Container Platform 4.14unaffected v4.14.0-202404161544.p0.g3362d67.assembly.stream.el8 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD