Improper Access Control Affecting atomic-openshift package, versions <0:3.1.1.6-1.git.0.b57e8bd.el7aos


Severity

Recommended
0.0
high
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.47% (76th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Access Control vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RHEL7-ATOMICOPENSHIFT-5398676
  • published1 Apr 2023
  • disclosed23 Mar 2015

Introduced: 23 Mar 2015

CVE-2015-1814  (opens in a new tab)
CWE-284  (opens in a new tab)

How to fix?

Upgrade RHEL:7 atomic-openshift to version 0:3.1.1.6-1.git.0.b57e8bd.el7aos or higher.
This issue was patched in RHSA-2016:0070.

NVD Description

Note: Versions mentioned in the description apply only to the upstream atomic-openshift package and not the atomic-openshift package as distributed by RHEL. See How to fix? for RHEL:7 relevant fixed versions and status.

The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.

CVSS Scores

version 3.1