CVE-2024-1139

Cluster-monitoring-operator: credentials leak

View on CVE.org
Published Apr 25, 2024 CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Description
A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-1331 A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.
Github GHSA Github GHSA GHSA-x5m7-63c6-fx79 Withdrawn Advisory: Cluster Monitoring Operator contains a credentials leak
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 5, 2026, 2:09 AM
Reserved
Jan 31, 2024, 8:48 PM

View source JSON

Updated
Aug 1, 2024, 6:26 PM

JSON

Status
Deferred
Published
Apr 25, 2024, 5:15 PM
Modified
Nov 5, 2026, 2:16 AM

View source JSON

Severity
Important
Public date
Apr 3, 2024, 9:19 AM

View source Bugzilla JSON

No data.