What is CVE-2020-25655?

CVE-2020-25655 is a medium-severity vulnerability in Red Hat Open-cluster-management, classified under Incorrect Authorization. CVSS score: 5.7/10. Published 2020-11-09.

How severe is CVE-2020-25655?

Medium severity. CVSS v3 base score is 5.7 out of 10.

Auth bypass in Red Hat Open-cluster-management

CVE-2020-25655

An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admin user would be made available for a short time to users with only view permissi…

Vulnerability class: Broken Access Control

EPSS: 0.006 (45.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N.

Affected products

Red Hat Open-cluster-management — versions 2.0.4, 2.1.0
Redhat Advanced_cluster_management_for_kubernetes — versions 2.0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

secalert@redhat.com (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2020-25655?: CVE-2020-25655 is a medium-severity vulnerability in Red Hat Open-cluster-management, classified under Incorrect Authorization. CVSS score: 5.7/10. Published 2020-11-09.
How severe is CVE-2020-25655?: Medium severity. CVSS v3 base score is 5.7 out of 10.