CVE-2019-10165CWE-532

OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenShift API server

Low · published July 30, 2019

CVSS v3.0
2.3
EPSS
0%
Percentile
31.3
In the wild
Unconfirmed
What it is

OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenShift API server. A user with sufficient privileges could recover OAuth tokens from these audit logs and use them to access other resources.

The record
Technical detail
CVSS v3.0
2.3 · LOW
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00384 · 31.3th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2019-07-30T22:18Z
EPSS history
Timeline
  • 30 JUL 22:18Z
    OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenShift API server
    cvelistv5