CVE-2016-5392

MEDIUM

Red Hat OpenShift Enterprise 3.2 - Authenticated Exposure of Sensitive Information via Watch-Cache List

Title source: llm

Description

The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of other project names to obtain sensitive project and user information via vectors related to the watch-cache list.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/91793

Issue Tracking x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=1356195

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2016:1427

Scores

CVSS v3 6.5

EPSS 0.0246

EPSS Percentile 82.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (1)

redhat/openshift 3.2

Published Aug 05, 2016

Tracked Since Feb 18, 2026