Information disclosure in Red Hat Openshift/cluster-Image-Registry-Operator
CVE-2020-10712
A flaw was found in OpenShift Container Platform version 4.1 and later. Sensitive information was found to be logged by the image registry operator allowing an attacker able to gain access to those logs, to read and write to the storage backing the internal image registry. The highest threat from this vulnerability is to data integrity.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L.
EPSS exploit prediction
EPSS: 0.010 (61.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 61st percentile — 61.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: +0.000
Affected products
- Red Hat Openshift/cluster-Image-Registry-Operator — versions all ose-cluster-image-registry-operator-container 4.1 versions and later
- Red Hat Openshift Container Platform
Weakness classification (CWE)
References
- bugzilla.redhat.com/show_bug.cgi (Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2020-10712?
- CVE-2020-10712 is a high-severity vulnerability in Red Hat Openshift/cluster-Image-Registry-Operator, classified under Insertion of Sensitive Information into Log File. CVSS score: 7.0/10. Published 2020-04-22.
- How severe is CVE-2020-10712?
- High severity. CVSS v3 base score is 7.0 out of 10.