The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidential webhook tokens.
CVSS Details
- CVSS 3.1 Base Score: 5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade nodejs-camelcaseUpgrade nodejs-invert-kvUpgrade python-cachetoolsUpgrade rubygem-thread_safeUpgrade nodejs-errnoUpgrade nodejs-decamelizeUpgrade nodejs-is-bufferUpgrade nodejs-openshift-auth-proxyUpgrade ansible-asb-modulesUpgrade nodejs-http-proxyUpgrade rubygem-domain_nameUpgrade elastic-curatorUpgrade rubygem-elasticsearch-transportUpgrade rubygem-rest-clientUpgrade jenkins-plugin-kubernetesUpgrade nodejs-has-ansiUpgrade nodejs-freshUpgrade nodejs-align-textUpgrade nodejs-is-finiteUpgrade atomic-openshift-dockerregistryUpgrade golang-github-prometheus-prometheusUpgrade rubygem-docker-apiUpgrade nodejs-grunt-contrib-lessUpgrade rubygem-unf_extUpgrade nodejs-string_decoderUpgrade nodejs-merge-descriptorsUpgrade thriftUpgrade rubygem-http-form_dataUpgrade jenkins-plugin-variantUpgrade python-openshiftUpgrade nodejs-form-dataUpgrade python-dictdifferUpgrade nodejs-longestUpgrade jenkins-plugin-workflow-aggregatorUpgrade nodejs-varyUpgrade nodejs-concat-streamUpgrade nodejs-type-isUpgrade nodejs-serve-staticUpgrade postgresql-apb-roleUpgrade rubygem-fluent-plugin-secure-forwardUpgrade jenkins-plugin-blueocean-webUpgrade nodejs-has-flagUpgrade jenkins-plugin-blueocean-configUpgrade nodejs-parseurlUpgrade nodejs-path-is-absoluteUpgrade jenkins-plugin-pipeline-utility-stepsUpgrade jenkins-plugin-workflow-step-apiUpgrade nodejs-promiseUpgrade jenkins-plugin-blueocean-rest-implUpgrade kibanaUpgrade nodejs-strip-ansiUpgrade nodejs-tough-cookieUpgrade nodejs-amdefineUpgrade nodejs-body-parserUpgrade nodejs-argparseUpgrade jenkins-plugin-multiple-scmsUpgrade nodejs-whichUpgrade jenkins-plugin-subversionUpgrade jenkins-plugin-workflow-scm-stepUpgrade nodejs-lodashUpgrade rubygem-ffiUpgrade nodejs-escape-htmlUpgrade jenkins-plugin-jackson2-apiUpgrade python-clamdUpgrade nodejs-finalhandlerUpgrade jenkins-plugin-token-macroUpgrade golang-github-prometheus-node_exporterUpgrade jenkins-plugin-workflow-apiUpgrade jenkins-plugin-blueocean-i18nUpgrade jenkins-plugin-openshift-clientUpgrade nodejs-on-headersUpgrade nodejs-grunt-contrib-cleanUpgrade nodejs-abbrevUpgrade python-cryptoUpgrade nodejs-pauseUpgrade mediawiki-container-scriptsUpgrade rubygem-fluent-plugin-kubernetes_metadata_filterUpgrade heapsterUpgrade nodejs-ctypeUpgrade jenkins-plugin-pipeline-model-extensionsUpgrade nodejs-esprimaUpgrade nodejs-asyncUpgrade nodejs-onceUpgrade nodejs-cookie-signatureUpgrade jenkins-plugin-pipeline-stage-tags-metadataUpgrade python-kubernetesUpgrade nodejs-map-objUpgrade jenkins-plugin-matrix-projectUpgrade nodejs-qsUpgrade sconsUpgrade nodejs-caselessUpgrade nodejs-destroyUpgrade hawkular-openshift-agentUpgrade nodejs-kind-ofUpgrade nodejs-bytesUpgrade jenkins-plugin-junitUpgrade nodejs-hookerUpgrade python-passlibUpgrade nodejs-extendUpgrade nodejs-camelcase-keysUpgrade rubygem-uuidtoolsUpgrade jenkins-plugin-blueocean-restUpgrade rubygem-multipart-postUpgrade jenkins-plugin-docker-commonsUpgrade rubygem-fluent-plugin-docker_metadata_filterUpgrade nodejs-is-propertyUpgrade rubygem-fluent-plugin-systemdUpgrade python-ruamel-yamlUpgrade nodejs-findup-syncUpgrade apb-base-scriptsUpgrade jenkins-plugin-ssh-credentialsUpgrade cri-toolsUpgrade golang-github-prometheus-promuUpgrade nodejs-ansi-stylesUpgrade nodejs-etagUpgrade rubygem-sigdumpUpgrade nodejs-sntpUpgrade nodejs-negotiatorUpgrade nodejs-is-unc-pathUpgrade nodejs-cliuiUpgrade mariadb-apb-roleUpgrade rubygem-syslog_protocolUpgrade nodejs-colorsUpgrade nodejs-graceful-fsUpgrade python-string_utilsUpgrade origin-kibanaUpgrade jenkins-plugin-pipeline-stage-viewUpgrade nodejs-cryptilesUpgrade nodejs-delayed-streamUpgrade image-inspectorUpgrade nodejs-rimrafUpgrade nodejs-passport-strategyUpgrade nodejs-assert-plusUpgrade nodejs-xtendUpgrade perl-IO-StringUpgrade python-crontabUpgrade jenkins-plugin-blueocean-personalizationUpgrade jenkins-plugin-pipeline-graph-analysisUpgrade jenkins-plugin-plain-credentialsUpgrade python-s3transferUpgrade jenkins-plugin-structsUpgrade nodejs-ee-firstUpgrade python-pyUpgrade rubygem-elasticsearch-apiUpgrade rubygem-proxifierUpgrade rubygem-fluent-plugin-record-modifierUpgrade jenkins-plugin-sse-gatewayUpgrade nodejs-requires-portUpgrade nodejs-graceful-readlinkUpgrade nodejs-unc-path-regexUpgrade nodejs-globUpgrade nodejs-patternflyUpgrade nodejs-aws-sign2Upgrade rubygem-tzinfoUpgrade nodejs-typedarrayUpgrade nodejs-packagingUpgrade nodejs-asn1Upgrade jenkins-plugin-blueocean-jwtUpgrade nodejs-keygripUpgrade ansible-service-brokerUpgrade nodejs-process-nextick-argsUpgrade nodejs-y18nUpgrade jenkins-plugin-blueocean-display-urlUpgrade nodejs-generate-object-propertyUpgrade atomic-openshiftUpgrade http-parserUpgrade python-boto3Upgrade nodejs-noptUpgrade atomic-openshift-web-consoleUpgrade rubygem-fluent-plugin-remote-syslogUpgrade rubygem-addressableUpgrade nodejs-passportUpgrade nodejs-node-uuidUpgrade jenkins-plugin-pipeline-model-apiUpgrade nodejs-array-flattenUpgrade python-mockUpgrade cri-oUpgrade rubygem-cool.ioUpgrade nodejs-file-sync-cmpUpgrade rubygem-fluent-plugin-elasticsearchUpgrade nodejs-http-signatureUpgrade jenkins-plugin-openshift-syncUpgrade nodejs-generate-functionUpgrade nodejs-util-deprecateUpgrade jenkins-plugin-blueocean-eventsUpgrade rubygem-public_suffixUpgrade nodejs-resolveUpgrade mediawiki123Upgrade jenkins-plugin-pubsub-lightUpgrade openshift-eventrouterUpgrade rubygem-string-scrubUpgrade jenkins-plugin-workflow-multibranchUpgrade jenkins-plugin-openshift-pipelineUpgrade jenkins-plugin-scm-apiUpgrade jenkins-plugin-pipeline-model-definitionUpgrade nodejs-depdUpgrade nodejs-indent-stringUpgrade rubygem-multi_jsonUpgrade rubygem-http-cookieUpgrade nodejs-har-validatorUpgrade jenkins-plugin-git-clientUpgrade python-dockerUpgrade nodejs-path-to-regexpUpgrade nodejs-methodsUpgrade nodejs-pseudomapUpgrade nodejs-underscore-dot-stringUpgrade rubygem-minitestUpgrade nodejs-prrUpgrade jenkins-plugin-blueocean-commonsUpgrade python-setuptoolsUpgrade dumb-initUpgrade rubygem-yajl-rubyUpgrade jenkins-plugin-docker-workflowUpgrade nodejs-readable-streamUpgrade nodejs-is-relativeUpgrade python-elasticsearchUpgrade nodejs-raw-bodyUpgrade nodejs-tunnel-agentUpgrade jenkins-plugin-momentjsUpgrade nodejs-oauth-signUpgrade rubygem-netrcUpgrade nodejs-core-util-isUpgrade golang-github-openshift-oauth-proxyUpgrade jenkins-plugin-credentialsUpgrade rubygem-fluent-mixin-config-placeholdersUpgrade nodejs-msUpgrade rubygem-elasticsearchUpgrade nodejs-grunt-cliUpgrade nodejs-commanderUpgrade nodejs-content-dispositionUpgrade jenkins-plugin-favoriteUpgrade nodejs-passport-http-bearerUpgrade rubygem-exconUpgrade python-pysocksUpgrade jenkins-plugin-pipeline-input-stepUpgrade nodejs-content-typeUpgrade rubygem-resolve-hostnameUpgrade openshift-external-storageUpgrade nodejs-eventemitter3Upgrade nodejs-meowUpgrade nodejs-grunt-legacy-log-utilsUpgrade nodejs-bluebirdUpgrade nodejs-yallistUpgrade mediawiki-apb-roleUpgrade nodejs-basic-authUpgrade nodejs-http-errorsUpgrade python-clickUpgrade cockpitUpgrade nodejs-inflightUpgrade nodejs-cookiesUpgrade jenkinsUpgrade jenkins-plugin-workflow-basic-stepsUpgrade jenkins-plugin-workflow-remote-loaderUpgrade nodejs-mimeUpgrade haproxyUpgrade rubygem-concurrent-rubyUpgrade nodejs-asapUpgrade ansible-kubernetes-modulesUpgrade nodejs-requestUpgrade jenkins-plugin-metricsUpgrade openshift-ansibleUpgrade jenkins-plugin-workflow-durable-task-stepUpgrade nodejs-wrappyUpgrade rubygem-fluent-plugin-rewrite-tag-filterUpgrade python-rsaUpgrade nodejs-isstreamUpgrade nodejs-json-stringify-safeUpgrade golang-github-openshift-prometheus-alert-bufferUpgrade nodejs-repeatingUpgrade nodejs-isarrayUpgrade rubygem-recursive-open-structUpgrade jenkins-plugin-pipeline-milestone-stepUpgrade jenkins-plugin-jquery-detachedUpgrade nodejs-debugUpgrade nodejs-lru-cacheUpgrade python-ruamel-ordereddictUpgrade rubygem-fluent-plugin-flatten-hashUpgrade nodejs-concat-mapUpgrade nodejs-on-finishedUpgrade jenkins-plugin-mailerUpgrade nodejsUpgrade nodejs-chalkUpgrade rubygem-i18nUpgrade jenkins-plugin-pipeline-rest-apiUpgrade jenkins-2-pluginsUpgrade nodejs-ipaddr.jsUpgrade nodejs-gruntUpgrade containernetworking-pluginsUpgrade nodejs-oauthUpgrade python-keyczarUpgrade nodejs-hawkUpgrade google-cloud-sdkUpgrade jenkins-plugin-openshift-loginUpgrade nodejs-uid2Upgrade jenkins-plugin-blueocean-pipeline-editorUpgrade nodejs-number-is-nanUpgrade nodejs-lcidUpgrade nodejs-os-localeUpgrade jenkins-plugin-mercurialUpgrade jenkins-plugin-githubUpgrade python-requests-oauthlibUpgrade nodejs-grunt-legacy-logUpgrade nodejs-utils-mergeUpgrade nodejs-inheritsUpgrade rubygem-activesupportUpgrade nodejs-range-parserUpgrade nodejs-escape-string-regexpUpgrade nodejs-wordwrapUpgrade nodejs-jsonpointerUpgrade mysql-apb-roleUpgrade nodejs-coffee-scriptUpgrade nodejs-exitUpgrade nodejs-sprintf-jsUpgrade nodejs-proxy-addrUpgrade jenkins-plugin-credentials-bindingUpgrade jenkins-plugin-workflow-jobUpgrade jenkins-plugin-authentication-tokensUpgrade jenkins-plugin-blueocean-autofavoriteUpgrade nodejs-morganUpgrade nodejs-grunt-contrib-copyUpgrade runcUpgrade rubygem-msgpackUpgrade nodejs-blUpgrade jenkins-plugin-git-serverUpgrade nodejs-js-yamlUpgrade jenkins-plugin-blueocean-pipeline-api-implUpgrade jenkins-plugin-branch-apiUpgrade openshift-enterprise-image-registryUpgrade nodejs-sendUpgrade nodejs-cookieUpgrade python-libcloudUpgrade elasticsearch-cloud-kubernetesUpgrade rubygem-mime-types-dataUpgrade rubygem-mime-typesUpgrade jenkins-plugin-pipeline-build-stepUpgrade golang-github-prometheus-alertmanagerUpgrade libuvUpgrade nodejs-window-sizeUpgrade python-urllib3Upgrade jenkins-plugin-blueocean-dashboardUpgrade jenkins-plugin-mapdb-apiUpgrade python-google-authUpgrade python-jwtUpgrade python-botocoreUpgrade apbUpgrade python-oauthlibUpgrade rubygem-http_parser.rbUpgrade jenkins-plugin-ace-editorUpgrade python-paramikoUpgrade nodejs-statusesUpgrade python-futuresUpgrade v8Upgrade nodejs-expressUpgrade search-guardUpgrade python-jmespathUpgrade nodejs-has-colorUpgrade jenkins-plugin-blueocean-git-pipelineUpgrade nodejs-is-absoluteUpgrade nodejs-center-alignUpgrade nodejs-grunt-legacy-utilUpgrade jenkins-plugin-pipeline-model-declarative-agentUpgrade nodejs-eventemitter2Upgrade nodejs-url-joinUpgrade rubygem-lru_reduxUpgrade nodejs-client-sessionsUpgrade rubygem-fluent-plugin-viaq_data_modelUpgrade python-botoUpgrade python-typingUpgrade rubygem-kubeclientUpgrade nodejs-minimatchUpgrade nodejs-lessUpgrade rubygem-tzinfo-dataUpgrade jenkins-plugin-blueoceanUpgrade nodejs-is-windowsUpgrade rubygem-faradayUpgrade openshift-elasticsearch-pluginUpgrade nodejs-base64urlUpgrade nodejs-unpipeUpgrade nodejs-right-alignUpgrade nodejs-ansi-regexUpgrade jenkins-plugin-blueocean-github-pipelineUpgrade nodejs-image-sizeUpgrade nodejs-repeat-stringUpgrade jenkins-plugin-github-branch-sourceUpgrade openvswitch-ovn-kubernetesUpgrade rubygem-httpUpgrade nodejs-supports-colorUpgrade jenkins-plugin-icon-shimUpgrade nodejs-media-typerUpgrade jenkins-plugin-workflow-cpsUpgrade jenkins-plugin-script-securityUpgrade sshpassUpgrade fluentdUpgrade jenkins-plugin-durable-taskUpgrade rubygem-unfUpgrade jenkins-plugin-pipeline-stage-stepUpgrade nodejs-brace-expansionUpgrade jenkins-plugin-display-url-apiUpgrade jenkins-plugin-workflow-cps-global-libUpgrade nodejs-hoekUpgrade nodejs-forwardedUpgrade nodejs-balanced-matchUpgrade nodejs-parse-durationUpgrade python-certifiUpgrade nodejs-mime-dbUpgrade jenkins-plugin-gitUpgrade nodejs-source-mapUpgrade nodejs-combined-streamUpgrade nodejs-forever-agentUpgrade nodejs-getobjectUpgrade rubygem-systemd-journalUpgrade jenkins-plugin-github-apiUpgrade nodejs-iconv-liteUpgrade nodejs-passport-oauth2Upgrade nodejs-mime-typesUpgrade nodejs-minimistUpgrade nodejs-mkdirpUpgrade jenkins-plugin-workflow-supportUpgrade nodejs-dateformatUpgrade jenkins-plugin-handlebarsUpgrade jenkins-plugin-matrix-authUpgrade nodejs-stringstreamUpgrade nodejs-is-my-json-validUpgrade nodejs-object-assignUpgrade python-httplib2Upgrade jenkins-plugin-cloudbees-folderUpgrade nodejs-acceptsUpgrade nodejs-yargsUpgrade nodejs-boomUpgrade elasticsearch | Jun 18, 2018 | Apr 11, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub