The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidential webhook tokens.
CVSS Details
- CVSS 3.1 Base Score: 5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade jenkins-plugin-scm-apiUpgrade python-crontabUpgrade rubygem-elasticsearch-apiUpgrade nodejs-esprimaUpgrade python-dockerUpgrade atomic-openshiftUpgrade nodejs-lodashUpgrade rubygem-fluent-plugin-remote-syslogUpgrade nodejs-typedarrayUpgrade nodejs-path-to-regexpUpgrade nodejs-pseudomapUpgrade jenkins-plugin-multiple-scmsUpgrade http-parserUpgrade rubygem-string-scrubUpgrade jenkins-plugin-blueocean-display-urlUpgrade nodejs-errnoUpgrade nodejs-merge-descriptorsUpgrade elasticsearchUpgrade jenkins-plugin-workflow-multibranchUpgrade origin-kibanaUpgrade mediawiki123Upgrade nodejs-cliuiUpgrade nodejs-indent-stringUpgrade nodejs-http-signatureUpgrade jenkins-plugin-git-clientUpgrade nodejs-parseurlUpgrade apb-base-scriptsUpgrade jenkins-plugin-pipeline-utility-stepsUpgrade nodejs-globUpgrade nodejs-type-isUpgrade rubygem-http-form_dataUpgrade jenkins-plugin-pipeline-model-apiUpgrade rubygem-fluent-plugin-kubernetes_metadata_filterUpgrade nodejs-has-flagUpgrade openshift-eventrouterUpgrade rubygem-rest-clientUpgrade nodejs-grunt-contrib-lessUpgrade jenkins-plugin-workflow-step-apiUpgrade golang-github-prometheus-node_exporterUpgrade nodejs-array-flattenUpgrade nodejs-cookie-signatureUpgrade jenkins-plugin-blueocean-rest-implUpgrade nodejs-passportUpgrade nodejs-depdUpgrade jenkins-plugin-token-macroUpgrade nodejs-noptUpgrade rubygem-ffiUpgrade kibanaUpgrade rubygem-elasticsearch-transportUpgrade nodejs-onceUpgrade hawkular-openshift-agentUpgrade elastic-curatorUpgrade python-s3transferUpgrade jenkins-plugin-openshift-syncUpgrade nodejs-har-validatorUpgrade ansible-asb-modulesUpgrade nodejs-requires-portUpgrade nodejs-etagUpgrade nodejs-generate-object-propertyUpgrade jenkins-plugin-structsUpgrade jenkins-plugin-matrix-projectUpgrade atomic-openshift-dockerregistryUpgrade jenkins-plugin-blueocean-eventsUpgrade jenkins-plugin-junitUpgrade golang-github-prometheus-promuUpgrade jenkins-plugin-pipeline-model-definitionUpgrade nodejs-graceful-readlinkUpgrade jenkins-plugin-openshift-clientUpgrade jenkins-plugin-pipeline-stage-tags-metadataUpgrade rubygem-tzinfoUpgrade nodejs-pauseUpgrade nodejs-findup-syncUpgrade nodejs-camelcase-keysUpgrade nodejs-bytesUpgrade python-kubernetesUpgrade nodejs-freshUpgrade rubygem-multipart-postUpgrade python-openshiftUpgrade jenkins-plugin-pipeline-graph-analysisUpgrade nodejs-finalhandlerUpgrade jenkins-plugin-workflow-scm-stepUpgrade nodejs-align-textUpgrade jenkins-plugin-blueocean-restUpgrade jenkins-plugin-docker-commonsUpgrade nodejs-ctypeUpgrade nodejs-is-propertyUpgrade postgresql-apb-roleUpgrade sconsUpgrade python-dictdifferUpgrade nodejs-file-sync-cmpUpgrade nodejs-qsUpgrade nodejs-unc-path-regexUpgrade nodejs-ee-firstUpgrade heapsterUpgrade nodejs-is-finiteUpgrade rubygem-fluent-plugin-docker_metadata_filterUpgrade nodejs-ansi-stylesUpgrade nodejs-generate-functionUpgrade nodejs-kind-ofUpgrade python-passlibUpgrade rubygem-multi_jsonUpgrade mediawiki-container-scriptsUpgrade jenkins-plugin-plain-credentialsUpgrade jenkins-plugin-workflow-apiUpgrade jenkins-plugin-sse-gatewayUpgrade rubygem-uuidtoolsUpgrade nodejs-util-deprecateUpgrade jenkins-plugin-jackson2-apiUpgrade mariadb-apb-roleUpgrade nodejs-xtendUpgrade nodejs-camelcaseUpgrade cri-toolsUpgrade ansible-service-brokerUpgrade nodejs-amdefineUpgrade nodejs-longestUpgrade python-string_utilsUpgrade nodejs-assert-plusUpgrade nodejs-cryptilesUpgrade jenkins-plugin-pipeline-model-extensionsUpgrade nodejs-is-unc-pathUpgrade rubygem-domain_nameUpgrade rubygem-cool.ioUpgrade nodejs-destroyUpgrade image-inspectorUpgrade python-clamdUpgrade nodejs-grunt-contrib-cleanUpgrade nodejs-map-objUpgrade nodejs-whichUpgrade nodejs-packagingUpgrade rubygem-fluent-plugin-secure-forwardUpgrade nodejs-caselessUpgrade rubygem-fluent-plugin-systemdUpgrade nodejs-form-dataUpgrade jenkins-plugin-kubernetesUpgrade rubygem-syslog_protocolUpgrade nodejs-asyncUpgrade rubygem-http-cookieUpgrade nodejs-resolveUpgrade nodejs-sntpUpgrade nodejs-delayed-streamUpgrade python-boto3Upgrade rubygem-thread_safeUpgrade rubygem-fluent-plugin-record-modifierUpgrade golang-github-prometheus-prometheusUpgrade python-mockUpgrade nodejs-methodsUpgrade rubygem-public_suffixUpgrade jenkins-plugin-openshift-pipelineUpgrade jenkins-plugin-blueocean-jwtUpgrade perl-IO-StringUpgrade nodejs-on-headersUpgrade rubygem-addressableUpgrade nodejs-decamelizeUpgrade nodejs-graceful-fsUpgrade nodejs-negotiatorUpgrade nodejs-process-nextick-argsUpgrade rubygem-sigdumpUpgrade rubygem-docker-apiUpgrade jenkins-plugin-variantUpgrade jenkins-plugin-pubsub-lightUpgrade rubygem-fluent-plugin-elasticsearchUpgrade python-pyUpgrade atomic-openshift-web-consoleUpgrade nodejs-argparseUpgrade nodejs-node-uuidUpgrade jenkins-plugin-pipeline-stage-viewUpgrade nodejs-y18nUpgrade nodejs-escape-htmlUpgrade nodejs-patternflyUpgrade nodejs-openshift-auth-proxyUpgrade nodejs-keygripUpgrade jenkins-plugin-workflow-aggregatorUpgrade nodejs-varyUpgrade jenkins-plugin-subversionUpgrade jenkins-plugin-blueocean-i18nUpgrade nodejs-passport-strategyUpgrade jenkins-plugin-blueocean-configUpgrade nodejs-asn1Upgrade nodejs-invert-kvUpgrade nodejs-has-ansiUpgrade nodejs-is-bufferUpgrade python-cachetoolsUpgrade nodejs-abbrevUpgrade nodejs-rimrafUpgrade jenkins-plugin-ssh-credentialsUpgrade rubygem-proxifierUpgrade python-cryptoUpgrade nodejs-aws-sign2Upgrade nodejs-extendUpgrade jenkins-plugin-blueocean-webUpgrade nodejs-colorsUpgrade nodejs-body-parserUpgrade rubygem-unf_extUpgrade nodejs-promiseUpgrade nodejs-path-is-absoluteUpgrade thriftUpgrade nodejs-concat-streamUpgrade nodejs-http-proxyUpgrade jenkins-plugin-blueocean-personalizationUpgrade nodejs-serve-staticUpgrade nodejs-strip-ansiUpgrade nodejs-tough-cookieUpgrade python-ruamel-yamlUpgrade nodejs-string_decoderUpgrade nodejs-hookerUpgrade nodejs-underscore-dot-stringUpgrade nodejs-tunnel-agentUpgrade jenkins-plugin-mercurialUpgrade python-clickUpgrade nodejs-hawkUpgrade rubygem-mime-typesUpgrade rubygem-activesupportUpgrade nodejs-cookiesUpgrade python-requests-oauthlibUpgrade rubygem-systemd-journalUpgrade nodejs-exitUpgrade rubygem-tzinfo-dataUpgrade rubygem-fluent-plugin-rewrite-tag-filterUpgrade jenkins-plugin-openshift-loginUpgrade nodejs-range-parserUpgrade nodejs-yargsUpgrade nodejs-passport-oauth2Upgrade nodejs-is-my-json-validUpgrade jenkins-plugin-git-serverUpgrade rubygem-unfUpgrade nodejs-isarrayUpgrade nodejs-mkdirpUpgrade rubygem-recursive-open-structUpgrade nodejs-expressUpgrade nodejs-lru-cacheUpgrade jenkins-plugin-pipeline-stage-stepUpgrade nodejs-content-dispositionUpgrade jenkins-plugin-favoriteUpgrade python-jmespathUpgrade python-typingUpgrade nodejs-brace-expansionUpgrade nodejs-mime-dbUpgrade jenkins-plugin-mapdb-apiUpgrade jenkins-plugin-pipeline-milestone-stepUpgrade nodejs-base64urlUpgrade jenkins-plugin-workflow-durable-task-stepUpgrade jenkins-plugin-workflow-basic-stepsUpgrade jenkins-plugin-mailerUpgrade nodejsUpgrade python-rsaUpgrade nodejs-is-windowsUpgrade nodejs-ansi-regexUpgrade nodejs-dateformatUpgrade search-guardUpgrade openvswitch-ovn-kubernetesUpgrade python-ruamel-ordereddictUpgrade nodejs-on-finishedUpgrade nodejs-url-joinUpgrade nodejs-parse-durationUpgrade nodejs-passport-http-bearerUpgrade nodejs-right-alignUpgrade nodejs-http-errorsUpgrade nodejs-unpipeUpgrade mysql-apb-roleUpgrade rubygem-minitestUpgrade openshift-enterprise-image-registryUpgrade jenkins-plugin-jquery-detachedUpgrade nodejs-jsonpointerUpgrade jenkins-plugin-durable-taskUpgrade openshift-elasticsearch-pluginUpgrade jenkins-plugin-pipeline-input-stepUpgrade nodejs-ipaddr.jsUpgrade jenkins-plugin-matrix-authUpgrade openshift-external-storageUpgrade apbUpgrade jenkins-plugin-blueocean-github-pipelineUpgrade jenkins-plugin-cloudbees-folderUpgrade jenkins-plugin-credentials-bindingUpgrade nodejs-grunt-legacy-logUpgrade nodejs-minimatchUpgrade rubygem-http_parser.rbUpgrade v8Upgrade jenkins-plugin-momentjsUpgrade nodejs-coffee-scriptUpgrade fluentdUpgrade nodejs-oauthUpgrade python-urllib3Upgrade nodejs-lessUpgrade jenkins-plugin-credentialsUpgrade rubygem-exconUpgrade nodejs-commanderUpgrade jenkins-plugin-workflow-supportUpgrade nodejs-basic-authUpgrade jenkins-plugin-blueocean-git-pipelineUpgrade nodejs-is-absoluteUpgrade nodejs-is-relativeUpgrade jenkinsUpgrade golang-github-prometheus-alertmanagerUpgrade golang-github-openshift-prometheus-alert-bufferUpgrade jenkins-plugin-blueoceanUpgrade nodejs-eventemitter2Upgrade nodejs-lcidUpgrade nodejs-grunt-cliUpgrade nodejs-repeat-stringUpgrade rubygem-i18nUpgrade nodejs-inheritsUpgrade jenkins-plugin-metricsUpgrade jenkins-plugin-workflow-cps-global-libUpgrade nodejs-os-localeUpgrade nodejs-grunt-legacy-log-utilsUpgrade nodejs-content-typeUpgrade nodejs-uid2Upgrade rubygem-mime-types-dataUpgrade rubygem-concurrent-rubyUpgrade dumb-initUpgrade nodejs-wrappyUpgrade jenkins-plugin-docker-workflowUpgrade jenkins-plugin-blueocean-pipeline-editorUpgrade nodejs-wordwrapUpgrade haproxyUpgrade mediawiki-apb-roleUpgrade nodejs-cookieUpgrade python-elasticsearchUpgrade python-botocoreUpgrade runcUpgrade python-oauthlibUpgrade nodejs-mimeUpgrade jenkins-plugin-authentication-tokensUpgrade jenkins-plugin-ace-editorUpgrade jenkins-2-pluginsUpgrade nodejs-js-yamlUpgrade jenkins-plugin-github-branch-sourceUpgrade nodejs-yallistUpgrade rubygem-fluent-mixin-config-placeholdersUpgrade nodejs-eventemitter3Upgrade nodejs-mime-typesUpgrade nodejs-grunt-legacy-utilUpgrade nodejs-prrUpgrade nodejs-readable-streamUpgrade rubygem-netrcUpgrade python-google-authUpgrade rubygem-fluent-plugin-flatten-hashUpgrade jenkins-plugin-handlebarsUpgrade nodejs-forwardedUpgrade nodejs-blUpgrade nodejs-meowUpgrade python-futuresUpgrade nodejs-isstreamUpgrade nodejs-json-stringify-safeUpgrade jenkins-plugin-blueocean-commonsUpgrade python-setuptoolsUpgrade jenkins-plugin-workflow-cpsUpgrade jenkins-plugin-workflow-remote-loaderUpgrade rubygem-faradayUpgrade nodejs-requestUpgrade jenkins-plugin-display-url-apiUpgrade nodejs-client-sessionsUpgrade nodejs-repeatingUpgrade nodejs-debugUpgrade nodejs-bluebirdUpgrade nodejs-number-is-nanUpgrade nodejs-gruntUpgrade nodejs-chalkUpgrade nodejs-concat-mapUpgrade jenkins-plugin-icon-shimUpgrade golang-github-openshift-oauth-proxyUpgrade nodejs-sprintf-jsUpgrade jenkins-plugin-github-apiUpgrade jenkins-plugin-gitUpgrade nodejs-media-typerUpgrade jenkins-plugin-workflow-jobUpgrade python-pysocksUpgrade nodejs-stringstreamUpgrade nodejs-sendUpgrade jenkins-plugin-blueocean-dashboardUpgrade nodejs-escape-string-regexpUpgrade nodejs-msUpgrade python-botoUpgrade jenkins-plugin-pipeline-rest-apiUpgrade nodejs-minimistUpgrade python-jwtUpgrade python-httplib2Upgrade jenkins-plugin-githubUpgrade nodejs-grunt-contrib-copyUpgrade sshpassUpgrade nodejs-asapUpgrade jenkins-plugin-script-securityUpgrade nodejs-inflightUpgrade rubygem-kubeclientUpgrade rubygem-elasticsearchUpgrade containernetworking-pluginsUpgrade nodejs-supports-colorUpgrade nodejs-acceptsUpgrade rubygem-httpUpgrade cockpitUpgrade nodejs-getobjectUpgrade nodejs-source-mapUpgrade nodejs-combined-streamUpgrade google-cloud-sdkUpgrade python-paramikoUpgrade rubygem-fluent-plugin-viaq_data_modelUpgrade nodejs-boomUpgrade nodejs-object-assignUpgrade rubygem-resolve-hostnameUpgrade nodejs-forever-agentUpgrade python-keyczarUpgrade nodejs-has-colorUpgrade nodejs-image-sizeUpgrade nodejs-core-util-isUpgrade jenkins-plugin-blueocean-autofavoriteUpgrade nodejs-raw-bodyUpgrade nodejs-hoekUpgrade nodejs-center-alignUpgrade nodejs-proxy-addrUpgrade nodejs-oauth-signUpgrade rubygem-yajl-rubyUpgrade openshift-ansibleUpgrade nodejs-utils-mergeUpgrade jenkins-plugin-branch-apiUpgrade python-certifiUpgrade rubygem-lru_reduxUpgrade ansible-kubernetes-modulesUpgrade nodejs-statusesUpgrade nodejs-window-sizeUpgrade python-libcloudUpgrade libuvUpgrade rubygem-msgpackUpgrade jenkins-plugin-blueocean-pipeline-api-implUpgrade nodejs-morganUpgrade jenkins-plugin-pipeline-model-declarative-agentUpgrade elasticsearch-cloud-kubernetesUpgrade nodejs-iconv-liteUpgrade jenkins-plugin-pipeline-build-stepUpgrade nodejs-balanced-matchUpgrade cri-o | Jun 18, 2018 | Apr 11, 2018 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub