CVE-2020-27836

Katalog CVE

CVSS 9.8 · Critical EPSS 1,2%

Kerentanan Incorrect Permission Assignment for Critical Resource pada redhat openshift container platform. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A flaw was found in cluster-ingress-operator. A change to how the router-default service allows only certain IP source ranges could allow an attacker to access resources that would otherwise be restricted to specified IP ranges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability..

Rincian

Terbit di NVD

22 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2020-27836 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=1905490 issue tracking · permissions required · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=1906267 issue tracking · patch · advisory vendor
• https://github.com/openshift/cluster-ingress-operator/pull/507/commits/92c83f281ba5fb6a1d91ecc3beaa4bcf2647a72... patch · advisory pihak ketiga