CVE-2024-7128

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-7128
A flaw was found in the OpenShift console. Several endpoints in the application use the authHandler() and authHandlerWithUser() middleware functions. When the default authentication provider ("openShiftAuth") is set, these functions do not perform any authentication checks, relying instead on the targeted service to handle authentication and authorization. This issue leads to various degrees of data exposure due to a lack of proper credential verification.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2025:4427
https://access.redhat.com/security/cve/CVE-2024-7128
https://bugzilla.redhat.com/show_bug.cgi?id=2300037
https://access.redhat.com/security/cve/CVE-2024-7128
https://bugzilla.redhat.com/show_bug.cgi?id=2300037
Configurations

No configuration.

History

09 May 2025, 05:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2025:4427 -

21 Nov 2024, 09:50

Type Values Removed Values Added
References () https://access.redhat.com/security/cve/CVE-2024-7128 - () https://access.redhat.com/security/cve/CVE-2024-7128 -
References () https://bugzilla.redhat.com/show_bug.cgi?id=2300037 - () https://bugzilla.redhat.com/show_bug.cgi?id=2300037 -
Summary (en) A flaw was found in the Openshift console. Several endpoints in the application use the authHandler() and authHandlerWithUser() middleware functions. When the default authentication provider ("openShiftAuth") is set, these functions do not perform any authentication checks, relying instead on the targeted service to handle authentication and authorization. This issue leads to various degrees of data exposure due to a lack of proper credential verification. (en) A flaw was found in the OpenShift console. Several endpoints in the application use the authHandler() and authHandlerWithUser() middleware functions. When the default authentication provider ("openShiftAuth") is set, these functions do not perform any authentication checks, relying instead on the targeted service to handle authentication and authorization. This issue leads to various degrees of data exposure due to a lack of proper credential verification.

29 Jul 2024, 14:12

Type Values Removed Values Added
Summary
  • (es) Se encontró un fallo en la consola Openshift. Varios endpoints de la aplicación utilizan las funciones de middleware authHandler() y authHandlerWithUser(). Cuando se establece el proveedor de autenticación predeterminado ("openShiftAuth"), estas funciones no realizan ninguna verificación de autenticación, sino que dependen del servicio de destino para manejar la autenticación y la autorización. Este problema conduce a diversos grados de exposición de datos debido a la falta de una verificación de credenciales adecuada.

26 Jul 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-26 14:15

Updated : 2025-05-09 05:15

NVD link : CVE-2024-7128

Mitre link : CVE-2024-7128

CVE.ORG link : CVE-2024-7128

JSON object : View

Products Affected

No product.

CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor