Information disclosure in Red Hat Noobaa-Operator
CVE-2021-3528
A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log files. An attacker with access to the log files could use this AuthToken to gain additional access into noobaa deployment and can read/modify system configuration.
EPSS: 0.009 (55.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Redhat Noobaa-operator
- N/a Noobaa — versions noobaa-operator 5.7.0
Weakness classification (CWE)
References
- secalert@redhat.com (Patch, x_refsource_MISC, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-3528?
- CVE-2021-3528 is a high-severity vulnerability in Red Hat Noobaa-Operator, classified under Insufficiently Protected Credentials. CVSS score: 8.8/10. Published 2021-05-13.
- How severe is CVE-2021-3528?
- High severity. CVSS v3 base score is 8.8 out of 10.