Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-10752

A flaw was found in the OpenShift API Server, where it failed to sufficiently protect OAuthTokens by leaking them into the logs when an API Server panic occurred. This flaw allows an attacker with the ability to cause an API Server error to read the logs, and use the leaked OAuthToken to log into the API Server with the leaked token.

Published

2020-06-12T23:15:10.367

Last Modified

2024-11-21T04:55:59.760

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

6.8

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-522
    CWE-532
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application redhat openshift_container_platform 3.11 Yes
Application redhat openshift_container_platform 4.0 Yes
References