CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1069
https://notcve.org/view.php?id=CVE-2018-1069
09 Mar 2018 — Red Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container network filesystems. An attacker could override the UserId and GroupId for GlusterFS and NFS to read and write any data on the network filesystem. Red Hat OpenShift Enterprise 3.7 es vulnerable a un reemplazo del control de acceso para los sistemas de archivos de red de contenedor. Un atacante podría reemplazar UserId y GroupId en GlusterFS y NFS para leer y escribir cualquier dato en el sistema de archivos de re... • http://www.securityfocus.com/bid/103364 • CWE-284: Improper Access Control CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2017-12195 – 3: authentication bypass for elasticsearch with external routes
https://notcve.org/view.php?id=CVE-2017-12195
28 Nov 2017 — A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the Elasticsearch be configured with an external route, and the data accessed is limited to the indices. Se ha encontrado un fallo en todas las versiones de Openshift Enterprise que utilizan el plugin openshift elasticsearch. Un ... • https://access.redhat.com/errata/RHSA-2017:3188 • CWE-287: Improper Authentication CWE-295: Improper Certificate Validation •