An input validation vulnerability exists in Openshift Enterprise due to a 1:1 mapping of tenants in Hawkular Metrics and projects/namespace…

Published 4 y ago 2022-10-17 · modified 4 mo ago 2026-06-17 · JSON

CVSS

3.5

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.6%

percentile 47%

Public exploits

none known

An input validation vulnerability exists in Openshift Enterprise due to a 1:1 mapping of tenants in Hawkular Metrics and projects/namespaces in OpenShift. If a user creates a project called "MyProject", and then later deletes it another user can then create a project called "MyProject" and access the metrics stored from the original "MyProject" instance.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 17 mo ago 2025-05-13

Exploit prediction (EPSS)

0.56% probability of exploitation in the next 30 days, higher than 47% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	3.5	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N`
NVD	3.1	3.5	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N`
CNA	3.1	3.5	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N`

Affected products

n/a Hawkular Metrics

Classification

Weakness

CWE-20 Improper Input Validation

References

bugzilla.redhat.com /show_bug.cgi?id=1470414 · x_transferred
access.redhat.com /security/cve/CVE-2017-7517 · x_transferred

Sources

CVE List: CVE-2017-7517
NVD: CVE-2017-7517

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary