High severity · published Feb 17, 2020
CVE-2020-1704
An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the…
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the openshift/istio-kialia-rhel7-operator-container. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Openshift Service Mesh · Redhat
before 1.0.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1704
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1704
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1704
More from Openshift Service Mesh
9.8
CVE-2021-3586
A flaw was found in servicemesh-operator
9.8
CVE-2020-27846
A signature verification vulnerability exists in crewjam/saml
8.8
CVE-2021-3495
An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7
8.6
CVE-2020-1762
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by…
8.6
CVE-2020-1764
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1