CVE-2025-6017mediumCWE-359

CVE-2025-6017: falha de média gravidade em ocm

Rhacm: users with clusterreader role can see credentials from managed-clusters

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat Advanced Cluster Management for Kubernetes+ Monitorar ocm

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.5epss 0.2%
A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials through the UI. This information should only be accessible to authorized users and may result in the loss of confidentiality of administrative information, which could be leaked to unauthorized actors.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
ocmRed Hat · Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9