CVE-2020-25655
published 2020-11-09CVE-2020-25655: An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.60%
45.2th percentile
An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admin user would be made available for a short time to users with only view permission. In this short time window the user with view permission could read cluster secrets that should only be disclosed to admin users.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| red_hat | open-cluster-management | — | — |
| red_hat | open-cluster-management | — | — |
| redhat | advanced_cluster_management_for_kubernetes | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
open-cluster-management: RBAC bypass may disclose cluster secrets to other users
vendor_redhat·2020-10-22·CVSS 5.7
CVE-2020-25655 [MEDIUM] CWE-863 open-cluster-management: RBAC bypass may disclose cluster secrets to other users
open-cluster-management: RBAC bypass may disclose cluster secrets to other users
An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admin user would be made available for a short time to users with only view permission. In this short time window the user with view permission could read cluster secrets that should only be disclosed to admin users.
A flaw was found in the ManagedClusterView API, allowed secrets to be disclosed to users without the correct permissions. Views created for an admin user are made available for a short time to users with view-only permission. In this short time window, the user with view-only permission can read cluster secrets that should only be disclosed to
GHSA
GHSA-fvqj-2g9g-f9xv: An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions
ghsa_unreviewed·2022-05-24
CVE-2020-25655 [MEDIUM] CWE-863 GHSA-fvqj-2g9g-f9xv: An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions
An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admin user would be made available for a short time to users with only view permission. In this short time window the user with view permission could read cluster secrets that should only be disclosed to admin users.
No detection rules found.
No public exploits indexed.
2020-11-09
Published