CVE Vulnerability

CVE-2020-10689

A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user can exploit this flaw to bypass JWT proxy and gain access to the workspace pods of another user. Successful exploitation requires knowledge of the service name and namespace of the target pod.

4.9 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 4.4 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

6.8 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10689 Issue Tracking Patch
https://github.com/eclipse/che/issues/15651 Exploit Issue Tracking
Configurations

Configuration 1

cpe:2.3:a:eclipse:che:*:*:*:*:*:*:*:*
Information

Published : 2020-04-03 03:15

Updated : 2021-12-20 10:56

NVD link : CVE-2020-10689

Mitre link : CVE-2020-10689

Products Affected
No products.
CWE
NVD-CWE-Other