CVE-2017-15138

atomic-openshift: cluster-reader can escalate to creating builds via webhooks in any project

Published Aug 13, 2018 CVSS 3.0 · 5 Medium EPSS < 1% KEV · Not listed
Description
The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidential webhook tokens.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2017-6598 The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidential webhook tokens.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 5, 2024, 7:50 PM
Reserved
Oct 8, 2017, 12:00 AM
Status
Modified
Published
Aug 13, 2018, 5:29 PM
Modified
Jun 17, 2026, 1:07 AM
Severity
Moderate
Public date
Apr 11, 2018, 12:00 AM