FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial
FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial

Exploit
CVE-2019-14854

Insertion of Sensitive Information into Log File (CWE-532)

Published: Jan 7, 2020 / Updated: 59mo ago

010
CVSS 6.5EPSS 0.08%Medium
CVE info copied to clipboard

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Timeline

First Article

Feedly found the first article mentioning CVE-2019-14854. See article

Oct 7, 2019 at 5:16 AM / bugzilla.redhat.com
EPSS

EPSS Score was set to: 0.08% (Percentile: 33.3%)

Sep 21, 2023 at 8:09 AM
Static CVE Timeline Graph

Affected Systems

Redhat/openshift_container_platform
+null more

Exploits

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14854
+null more

Links to Mitre Att&cks

T1070: Indicator Removal on Host
+null more

Attack Patterns

CAPEC-215: Fuzzing for application mapping
+null more

News

CVE-2019-14854 | Openshift Container Platform 4 Static Pod Log neutralization for logs (RHSA-2019:4075)
VulDB Updates / 8mo
A vulnerability, which was classified as problematic , was found in Openshift Container Platform 4 . This affects an unknown part of the component Static Pod Log Handler . The manipulation leads to improper output neutralization for logs. This vulnerability is uniquely identified as CVE-2019-14854 . It is possible to initiate the attack remotely. There is no exploit available.

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:None
Availability Impact:None

Categories

CVSS 6.5(29816)CWE-532(828)CWE-117(81)Redhat(5492)

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI

Feedly Threat Intelligence30-day free trial