PT-2016-1270 · Red Hat · Openshift

Jwforres · Published 2016-02-03 · Updated 2024-08-21 · CVE-2016-1906

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Openshift (affected versions not specified)

Description The issue is related to a lack of access control in the interface of a cluster management tool for Kubernetes virtual machines, allowing remote attackers to elevate their privileges. This can be achieved by editing a build configuration. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

CWE-264

Related Identifiers

BDU:2016-00543

CVE-2016-1906

GHSA-M3FM-H5JP-Q79P

GO-2022-0854

RHSA-2016:0070

RHSA-2016:0351

Affected Products

Openshift

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2016-1906 · Security Note
• https://access.redhat.com/errata/RHSA-2016:0070 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2016:0351 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m3fm-h5jp-q79p · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0854 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00543 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1906 · Vendor Advisory
• https://github.com/openshift/origin/pull/6576 · Note
• https://github.com/openshift/origin/issues/6556 · Note
• https://github.com/openshift/origin/commit/d95ec085f03ecf10e8c424a4f0340ddb38891406 · Note
• https://github.com/advisories/GHSA-m3fm-h5jp-q79p · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1297916 · Note
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1906 · Note
• https://access.redhat.com/security/cve/CVE-2016-1906 · Note