CVE-2017-15138

atomic-openshift: cluster-reader can escalate to creating builds via webhooks in any project

Published Aug 13, 2018 CVSS 3.0 · 5 Medium EPSS < 1% KEV · Not listed
Description
The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidential webhook tokens.

Analysis

No analysis available yet

Remediation

No remediation available yet

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2017-6598 The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidential webhook tokens.
History

No history.

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-285

    Improper Authorization

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 5, 2024, 7:50 PM
Reserved
Oct 8, 2017, 12:00 AM
Status
Modified
Published
Aug 13, 2018, 5:29 PM
Modified
Jun 17, 2026, 1:07 AM
Severity
Moderate
Public date
Apr 11, 2018, 12:00 AM