Vulnerability DatabaseCVE-2024-1139
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2024-1139
April 25, 2024
A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.
Related Resources (12)
https://bugzilla.redhat.com/show_bug.cgi?id=2262158
https://github.com/openshift/cluster-monitoring-operator/blob/d45a3335c2bbada0948adef9fcba55c4e14fa1d7/pkg/manifests/manifests.go#L3135
https://github.com/openshift/cluster-monitoring-operator/pull/1747
https://access.redhat.com/errata/RHSA-2024:2047
https://access.redhat.com/security/cve/CVE-2024-1139
https://nvd.nist.gov/vuln/detail/CVE-2024-1139
https://access.redhat.com/errata/RHSA-2024:1891
https://github.com/openshift/cluster-monitoring-operator/commit/1cfbe9ffafe1e43f8f87a451b72fddf5d76fa4e3
https://access.redhat.com/errata/RHSA-2024:1887
https://access.redhat.com/errata/RHSA-2024:2782
https://github.com/openshift/cluster-monitoring-operator
https://github.com/advisories/GHSA-x5m7-63c6-fx79
Do you need more information?
Contact Us
CVSS v4
Base Score:
8.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.7
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
EPSS
Base Score:
0.12