CVE-2025-2842

A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2025:3607
https://access.redhat.com/errata/RHSA-2025:3740
https://access.redhat.com/security/cve/CVE-2025-2842
https://bugzilla.redhat.com/show_bug.cgi?id=2355219

Configurations

No configuration.

History

No history.

Information

Published : 2025-04-02 12:15

Updated : 2025-04-09 21:16

NVD link : CVE-2025-2842

Mitre link : CVE-2025-2842

CVE.ORG link : CVE-2025-2842

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2025-2842", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-04-02T12:15:14.677", "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:3607", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2025:3740", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2025-2842", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2355219", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole.\nThis can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics."}, {"lang": "es", "value": "Se detect\u00f3 una falla en Tempo Operator. Al habilitar la pesta\u00f1a Monitor de la interfaz de usuario de Jaeger en una instancia de Tempo administrada por el operador Tempo, este crea un ClusterRoleBinding para la cuenta de servicio de la instancia de Tempo para otorgar el ClusterRole de vista de monitorizaci\u00f3n de cl\u00faster. Esto puede explotarse si un usuario tiene permisos de creaci\u00f3n en TempoStack y permisos de obtenci\u00f3n en Secret en un espacio de nombres (por ejemplo, un usuario tiene permisos de administrador de cl\u00faster para un espacio de nombres espec\u00edfico), ya que el usuario puede leer el token de la cuenta de servicio de Tempo y, por lo tanto, tiene acceso para ver todas las m\u00e9tricas del cl\u00faster."}], "lastModified": "2025-04-09T21:16:25.913", "sourceIdentifier": "secalert@redhat.com"}