CVE-2019-3869CWE-214

When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables

High · published March 28, 2019

CVSS v3.0
7.2
EPSS
1%
Percentile
69.5
In the wild
Unconfirmed
What it is

When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.

The record
Technical detail
CVSS v3.0
7.2 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01266 · 69.5th percentile
Weakness
CWE-214 · Invocation of Process Using Visible Sensitive Information
Published
2019-03-28T13:04Z
EPSS history
Timeline
  • 28 MAR 13:04Z
    When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables
    cvelistv5