PT-2025-11515 · Hive · Hive

Published 2025-03-11 · Updated 2025-03-19 · CVE-2025-2241

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Hive versions (affected versions not specified)

Description A flaw in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM), causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials, leading to unauthorized VCenter access, cluster management, and privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

BDU:2025-02918

CVE-2025-2241

GHSA-C339-MWFC-FMR2

GO-2025-3529

OPENSUSE-SU-2025:14910-1

Affected Products

Hive

References · 19

• https://osv.dev/vulnerability/GHSA-c339-mwfc-fmr2 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14910-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02918 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-2241 · Security Note
• https://osv.dev/vulnerability/GO-2025-3529 · Vendor Advisory
• https://github.com/openshift/hive/pull/2612 · Note
• https://github.com/openshift/hive · Note
• https://t.me/cvedetector/20491 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2351350 · Note
• https://suse.com/security/cve/CVE-2025-29786 · Note
• https://twitter.com/vulns_space/status/1901687693752558057 · Twitter Post
• https://suse.com/security/cve/CVE-2024-40635 · Note
• https://twitter.com/cybercronai/status/1902269569500377417 · Twitter Post
• https://suse.com/security/cve/CVE-2025-29781 · Note
• https://access.redhat.com/security/cve/CVE-2025-2241 · Note