CVE-2020-1706 — Incorrect Permission Assignment in RED HAT Openshift Apb-tools-container

CWE-732 — Incorrect Permission Assignment5 documents5 sources
Severity
7.0HIGHNVD
EPSS
0.1%
top 73.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
RED HAT Openshift Apb-tools-containerRedhat Openshift Container Platform
Timeline
PublishedMar 9
Latest updateMay 24

Description

It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/apb-tools-container.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages1 packages

▶CVEListV5red_hat/openshift_apb-tools-containerfrom openshift-enterprise version 4.1 to, including 4.3, openshift-enterprise version 3.11+1

Also affects: Openshift Container Platform 3.11, 4.1, 4.2, 4.3

🔴Vulnerability Details

2
GHSA
GHSA-j28m-qhxw-4r5g: It has been found that in openshift-enterprise version 3↗2022-05-24
▶
CVEList
CVE-2020-1706: It has been found that in openshift-enterprise version 3↗2020-03-09
▶

📋Vendor Advisories

1
Red Hat
openshift/apb-tools: /etc/passwd is given incorrect privileges↗2020-01-21
▶

💬Community

1
Bugzilla
CVE-2020-1706 openshift/apb-tools: /etc/passwd is given incorrect privileges↗2020-01-21
▶
CVE-2020-1706 — Incorrect Permission Assignment in RED | cvebase