CVE-2020-25655: Medium severity red hat advanced cluster management for kubernetes vulnerability

Published Nov 9, 2020

Updated

An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admin user would be made available for a short time to users with only view permission. In this short time window the user with view permission could read cluster secrets that should only be disclosed to admin users.

Affected Software

1 affected component

redhat Advanced Cluster Management For Kubernetes=2.0

Event History

Nov 9, 2020

CVE Published

via MITRE·02:38 PM

Data Sourced

via MITRE·02:38 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2020-25655?

CVE-2020-25655 is a vulnerability in the ManagedClusterView API that can allow secrets to be disclosed to users without the correct permissions.

What is the severity of CVE-2020-25655?

CVE-2020-25655 has a severity rating of medium (6.5).

What software is affected by CVE-2020-25655?

CVE-2020-25655 affects Redhat Advanced Cluster Management For Kubernetes version 2.0.

How can the CVE-2020-25655 vulnerability be exploited?

The CVE-2020-25655 vulnerability can be exploited by users with view permission accessing views created for an admin user during a short time window.

Is there a fix for CVE-2020-25655?

Yes, it is recommended to update to a patched version of Redhat Advanced Cluster Management For Kubernetes to fix the CVE-2020-25655 vulnerability.