CVE-2020-10752

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Insufficiently Protected Credentials pada redhat openshift container platform. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in the OpenShift API Server, where it failed to sufficiently protect OAuthTokens by leaking them into the logs when an API Server panic occurred. This flaw allows an attacker with the ability to cause an API Server error to read the logs, and use the leaked OAuthToken to log into the API Server with the leaked token.

Rincian

Terbit di NVD

12 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-522: Insufficiently Protected Credentials
CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openshift/enhancements/pull/323 patch · advisory pihak ketiga
• https://github.com/openshift/origin/blob/master/vendor/k8s.io/kubernetes/staging/src/k8s.io/apiserver/pkg/serv... advisory pihak ketiga