CVE-2019-19355CWE-266

An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk

High · published March 18, 2020

CVSS v3.1
7.0
EPSS
0%
Percentile
14.8
In the wild
Unconfirmed
What it is

An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. This CVE is specific to the openshift/ansible-operator-container as shipped in Openshift 4.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00245 · 14.8th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2020-03-18T16:35Z
EPSS history
Timeline
  • 18 MAR 16:35Z
    An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk
    cvelistv5