CVE-2020-10689

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user can exploit this flaw to bypass JWT proxy and gain access to the workspace pods of another user. Successful exploitation requires knowledge of the service name and namespace of the target pod.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Red Hat	Eclipse Che	7.8.x

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10689Issue Tracking, Patch, Third Party Advisory
https://github.com/eclipse/che/issues/15651Exploit, Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10689Issue Tracking, Patch, Third Party Advisory
https://github.com/eclipse/che/issues/15651Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Apr 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-10698.8A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web CVE-2020-106906.4There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource dea CVE-2020-106915.2An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. Whe CVE-2020-106935.3A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to CVE-2020-106957.8An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access to the container can CVE-2020-106968.8A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious CVE-2020-106974.4A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can take advantage CVE-2020-106983.3A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run fr CVE-2020-106997.8A flaw was found in Linux, in targetcli-fb versions 2.1.50 and 2.1.51 where the socket used by targetclid was world-writable. If a system en CVE-2020-10707.8An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system CVE-2020-107005.3A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with the 'ASQ' control. A m CVE-2020-107016.5A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. This flaw allows read-on