CVE-2025-2241
March 17, 2025, 5:15 p.m.
8.2
High
Description
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.
Product(s) Impacted
| Vendor | Product | Versions |
|---|---|---|
| Redhat |
|
|
Weaknesses
CWE-922
Insecure Storage of Sensitive Information
The product stores sensitive information without properly limiting read or write access by unauthorized actors.
*CPE(s)
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | redhat | hive | / | / | / | / | / | / | / | / |
| a | redhat | multicluster_engine | / | / | / | / | / | / | / | / |
| a | redhat | advanced_cluster_management | / | / | / | / | / | / | / | / |
Tags
CVSS Score
CVSS Data
- Attack Vector: NETWORK
- Attack Complexity: HIGH
- Privileges Required: LOW
- Scope: CHANGED
- Confidentiality Impact: HIGH
- Integrity Impact: HIGH
- Availability Impact: NONE
View Vector String
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Date
- Published: March 17, 2025, 5:15 p.m.
- Last Modified: March 17, 2025, 5:15 p.m.
Status : Received
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
secalert@redhat.com
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.