CVE-2017-7517

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

An input validation vulnerability exists in Openshift Enterprise due to a 1:1 mapping of tenants in Hawkular Metrics and projects/namespaces in OpenShift. If a user creates a project called "MyProject", and then later deletes it another user can then create a project called "MyProject" and access the metrics stored from the original "MyProject" instance.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	Hawkular Metrics	Hawkular Metrics as shipped in Red Hat Openshift 3.x

References

https://access.redhat.com/security/cve/CVE-2017-7517Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1470414Issue Tracking, Vendor Advisory
https://access.redhat.com/security/cve/CVE-2017-7517Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1470414Issue Tracking, Vendor Advisory

Timeline

Published: Oct 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-75187.8A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulatio CVE-2017-75194.4In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service usin CVE-2017-75207.4OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-i CVE-2017-75215.9OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks a CVE-2017-75226.5OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certifica CVE-2017-75237.5Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow vulnerability in wcsxfrm/wcsxfrm_l functions resulting int CVE-2017-75247.5tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when gene CVE-2017-75259.8A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica CVE-2017-75266.8libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left CVE-2017-75286.5Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that X-Forwarded-For head CVE-2017-75297.5Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resultin CVE-2017-75308.8In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbit