CVE-2024-1139highCWE-200

CVE-2024-1139: falha de alta gravidade em cluster-monitoring-operator

Cluster-monitoring-operator: credentials leak

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat OpenShift Container Platform+ Monitorar Red Hat Advanced Cluster Management for Kubernetes

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.9%
A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
cluster-monitoring-operatorRed Hat · Red Hat Advanced Cluster Management for Kubernetes 2Red Hat · Red Hat OpenShift Container Platform 3.11Red Hat · Red Hat OpenShift Container Platform 4.12Red Hat · Red Hat OpenShift Container Platform 4.13Red Hat · Red Hat OpenShift Container Platform 4.14Red Hat · Red Hat OpenShift Container Platform 4.15
CVEs relacionadas — cluster-monitoring-operator

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3154HIGHCri-o: arbitrary command injection via pod annotationEPSS 1.4%CVE-2024-0567HIGHGnutls: rejects certificate chain with distributed trustEPSS 1.4%CVE-2026-66786CRITICALSubmariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnetsEPSS 1.4%CVE-2024-3727HIGHContainers/image: digest type does not guarantee valid typeEPSS 1.3%CVE-2023-3966HIGHOpenvswsitch: ovs-vswitch fails to recover after malformed geneve metadata packetEPSS 1.3%CVE-2024-5154HIGHCri-o: malicious container can create symlink on hostEPSS 1.2%