CVE-2016-2149
published 2016-06-08CVE-2016-2149: Red Hat OpenShift Enterprise 3.2 allows remote authenticated users to read log files from another namespace by using the same name as a previously deleted…
PriorityP336medium6.5CVSS 3.0
AVNACLPRLUINSUCHINAN
EPSS
1.54%
72.2th percentile
Red Hat OpenShift Enterprise 3.2 allows remote authenticated users to read log files from another namespace by using the same name as a previously deleted namespace when creating a new namespace.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | openshift | — | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rvh3-qxj7-9f8x: Red Hat OpenShift Enterprise 3
ghsa_unreviewed·2022-05-17
CVE-2016-2149 [MEDIUM] CWE-200 GHSA-rvh3-qxj7-9f8x: Red Hat OpenShift Enterprise 3
Red Hat OpenShift Enterprise 3.2 allows remote authenticated users to read log files from another namespace by using the same name as a previously deleted namespace when creating a new namespace.
Red Hat
3: logs from a deleted namespace can be revealed if a new namespace with the same name is created
vendor_redhat·2016-03-09·CVSS 6.5
CVE-2016-2149 [MEDIUM] CWE-285 3: logs from a deleted namespace can be revealed if a new namespace with the same name is created
3: logs from a deleted namespace can be revealed if a new namespace with the same name is created
Red Hat OpenShift Enterprise 3.2 allows remote authenticated users to read log files from another namespace by using the same name as a previously deleted namespace when creating a new namespace.
It was found that OpenShift Enterprise would disclose log file contents from reclaimed namespaces. An attacker could create a new namespace to access log files present in a previously deleted namespace using the same name.
No detection rules found.
No public exploits indexed.
2016-06-08
Published