CVE-2024-9453: fallo de gravedad media en Jenkins openshift-sync-plugin
Jenkins-image: sensitive data disclosure when using openshift jenkins image
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear OpenShift Developer Tools and Services+ Monitorear openshift-sync-plugin
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.4%
A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if they have access to sensitive information.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVEs relacionadas — Jenkins openshift-sync-plugin
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-1394HIGHGolang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsEPSS 1.5%CVE-2024-9676MEDIUMPodman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)EPSS 1.3%CVE-2024-3727HIGHContainers/image: digest type does not guarantee valid typeEPSS 1.3%CVE-2024-1485HIGHRegistry-support: decompress can delete files outside scope via relative pathsEPSS 0.9%CVE-2024-9675HIGHBuildah: buildah allows arbitrary directory mountEPSS 0.4%CVE-2024-9355MEDIUMGolang-fips: golang fips zeroed bufferEPSS 0.3%