CVE-2025-6017

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-6017
A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials through the UI. This information should only be accessible to authorized users and may result in the loss of confidentiality of administrative information, which could be leaked to unauthorized actors.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2025-6017 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2372362 Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:*
History

20 Aug 2025, 16:33

Type Values Removed Values Added
CPE cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:*
First Time Redhat advanced Cluster Management For Kubernetes
Redhat
References () https://access.redhat.com/security/cve/CVE-2025-6017 - () https://access.redhat.com/security/cve/CVE-2025-6017 - Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2372362 - () https://bugzilla.redhat.com/show_bug.cgi?id=2372362 - Issue Tracking, Vendor Advisory

03 Jul 2025, 15:13

Type Values Removed Values Added
Summary
  • (es) Se detectó una falla en Red Hat Advanced Cluster Management en las versiones 2.10 (anteriores a la 2.10.7), 2.11 (anteriores a la 2.11.4) y 2.12 (anteriores a la 2.12.4). Esta vulnerabilidad permite a un usuario sin privilegios acceder a las credenciales confidenciales del clúster administrado a través de la interfaz de usuario. Esta información solo debería ser accesible para usuarios autorizados y puede provocar la pérdida de confidencialidad de la información administrativa, que podría filtrarse a usuarios no autorizados.

02 Jul 2025, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-02 07:15

Updated : 2025-08-20 16:33

NVD link : CVE-2025-6017

Mitre link : CVE-2025-6017

CVE.ORG link : CVE-2025-6017

JSON object : View

Products Affected

redhat

  • advanced_cluster_management_for_kubernetes
CWE
CWE-359

Exposure of Private Personal Information to an Unauthorized Actor