Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade nodejs-lodash.isiterateecallUpgrade nodejs-lodash.basecopyUpgrade nodejs-touchUpgrade nodejs-registry-urlUpgrade nodejs-update-notifierUpgrade nodejs-splitUpgrade nodejs-kind-ofUpgrade nodejs-url-parse-laxUpgrade nodejs-lodash.keysUpgrade nodejs-duplexifyUpgrade nodejs-repeat-elementUpgrade nss_wrapperUpgrade nodejs-arr-diffUpgrade nodejs-throughUpgrade openshift-ansibleUpgrade nodejs-is-equal-shallowUpgrade nodejs-fill-rangeUpgrade nodejs-iniUpgrade nodejs-for-ownUpgrade nodejs-is-numberUpgrade nodejs-uuidUpgrade nodejs-package-jsonUpgrade nodejs-is-streamUpgrade nodejs-expand-rangeUpgrade origin-kibanaUpgrade nodejs-lazy-cacheUpgrade nodejs-read-all-streamUpgrade nodejs-end-of-streamUpgrade nodejs-prepend-httpUpgrade nodejs-anymatchUpgrade nodejs-gotUpgrade nodejs-unzip-responseUpgrade nodejs-is-binary-pathUpgrade nodejs-normalize-pathUpgrade nodejs-extglobUpgrade nodejs-is-dotfileUpgrade nodejs-glob-baseUpgrade nodejs-slideUpgrade nodejs-pinkie-promiseUpgrade nodejs-graceful-fsUpgrade openshiftUpgrade nodejs-string-lengthUpgrade jenkinsUpgrade nodejs-is-redirectUpgrade nodejs-bracesUpgrade nodejs-configstoreUpgrade nodejs-lodash.getnativeUpgrade nodejs-readdirpUpgrade nodejs-create-error-classUpgrade nodejs-lodash.defaultsUpgrade nodejs-undefsafeUpgrade nodejs-strip-json-commentsUpgrade nodejs-deep-extendUpgrade nodejs-binary-extensionsUpgrade nodejs-lodash.isarrayUpgrade heapsterUpgrade nodejs-pause-streamUpgrade nodejs-ansi-wrapUpgrade nodejs-pinkieUpgrade nodejs-arr-flattenUpgrade nodejs-os-homedirUpgrade nodejs-optimistUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-xdg-basedirUpgrade nodejs-chokidarUpgrade nodejs-semver-diffUpgrade nodejs-capture-stack-traceUpgrade nodejs-mkdirpUpgrade nodejs-fromUpgrade nodejs-is-plain-objUpgrade nodejs-lodash.restparamUpgrade nodejs-for-inUpgrade nodejs-ansi-greenUpgrade nodejs-filename-regexUpgrade nodejs-glob-parentUpgrade nodejs-map-streamUpgrade nodejs-write-file-atomicUpgrade nodejs-randomaticUpgrade nodejs-is-npmUpgrade nodejs-parse-globUpgrade nodejs-duplexerUpgrade atomic-openshiftUpgrade nodejs-object-assignUpgrade nodejs-object.omitUpgrade nodejs-rcUpgrade nodejs-lodash.baseassignUpgrade nodejs-success-symbolUpgrade nodejs-async-eachUpgrade nodejs-array-uniqueUpgrade nodejs-lodash.createassignerUpgrade nodejs-is-extglobUpgrade nodejs-parse-jsonUpgrade nodejs-semverUpgrade nodejs-preserveUpgrade openvswitchUpgrade nodejs-regex-cacheUpgrade nodejs-is-globUpgrade nodejs-node-status-codesUpgrade nodejs-timed-outUpgrade nodejs-event-streamUpgrade nodejs-error-exUpgrade nodejs-is-extendableUpgrade nodejs-osenvUpgrade nodejs-align-textUpgrade nodejs-micromatchUpgrade nodejs-nodemonUpgrade nodejs-lodash.isargumentsUpgrade nodejs-isobjectUpgrade nodejs-lowercase-keysUpgrade nodejs-ps-treeUpgrade nodejs-lodash.assignUpgrade nodejs-expand-bracketsUpgrade nodejs-stream-combinerUpgrade nodejs-os-tmpdirUpgrade nodejs-latest-versionUpgrade nodejs-es6-promiseUpgrade nodejs-is-primitiveUpgrade nodejs-arrify | Jun 18, 2018 | Jan 6, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 6, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub