VDB
CVE-2021-3528
CVE-2021-3528
PUBLISHED
CVSS 8.800000190734863 HIGH
A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log files. An attacker with access to the log files could use this AuthToken to gain additional access into noobaa deployment and can read/modify system configuration.
EPSS 0.89% · 57.8th percentile
Risk Scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.89%
57.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | NooBaa | noobaa-operator 5.7.0 |
| redhat | noobaa-operator | 0 |
Timeline
- May 13, 2021 CVE Published
- May 14, 2021 EPSS Score
- Jul 17, 2021 EPSS Score
- Sep 18, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Jan 20, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 23, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 25, 2022 EPSS Score
- Sep 27, 2022 EPSS Score
- Nov 28, 2022 EPSS Score