CVE-2025-14243

A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses via different error messages during authentication failures and account creation.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-14243	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2419829	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:mirror_registry_for_red_hat_openshift:-:::::::*
	cpe:2.3:a:redhat:mirror_registry_for_red_hat_openshift:2.0:::::::*

History

No history.

Information

Published : 2026-04-08 17:20

Updated : 2026-07-25 10:10

NVD link : CVE-2025-14243

Mitre link : CVE-2025-14243

CVE.ORG link : CVE-2025-14243

JSON object : View

Products Affected

redhat

mirror_registry_for_red_hat_openshift

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2025-14243", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14243", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T19:14:34.911976Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:mirror_registry:1"], "vendor": "Red Hat", "product": "mirror registry for Red Hat OpenShift", "packageName": "openshift/mirror-registry-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:mirror_registry:2"], "vendor": "Red Hat", "product": "mirror registry for Red Hat OpenShift 2", "packageName": "openshift/mirror-registry-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2026-04-08T17:20:25.247", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-14243", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419829", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email addresses via different error messages during authentication failures and account creation."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el OpenShift Mirror Registry. Esta vulnerabilidad permite a un atacante remoto no autenticado enumerar nombres de usuario y direcciones de correo electr\u00f3nico v\u00e1lidos a trav\u00e9s de diferentes mensajes de error durante fallas de autenticaci\u00f3n y creaci\u00f3n de cuentas."}], "lastModified": "2026-07-25T10:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:mirror_registry_for_red_hat_openshift:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63757310-FC5B-44E6-9211-36269827BC56"}, {"criteria": "cpe:2.3:a:redhat:mirror_registry_for_red_hat_openshift:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "281E6AA4-1E08-488F-BA7A-F0BE7CF42A5B"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}