Information disclosure in Red Hat Openshift/cluster-Image-Registry-Operator
CVE-2020-10712
A flaw was found in OpenShift Container Platform version 4.1 and later. Sensitive information was found to be logged by the image registry operator allowing an attacker able to gain access to those logs, to read and write to the storage backing the internal image registry. The highest threat from this vulnerability is to data integrity.
EPSS: 0.010 (58.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L.
Affected products
- Red Hat Openshift/cluster-image-registry-operator — versions all ose-cluster-image-registry-operator-container 4.1 versions and later
- Redhat Openshift_container_platform
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2020-10712?
- CVE-2020-10712 is a high-severity vulnerability in Red Hat Openshift/cluster-Image-Registry-Operator, classified under Insertion of Sensitive Information into Log File. CVSS score: 7.0/10. Published 2020-04-22.
- How severe is CVE-2020-10712?
- High severity. CVSS v3 base score is 7.0 out of 10.