{"cve":"CVE-2017-12195","nvd":{"published":"2018-07-27T15:29:00.297","modified":"2026-06-17T01:02:52.797","status":"Modified","description":"A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the Elasticsearch be configured with an external route, and the data accessed is limited to the indices.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8},"cwes":["CWE-287","CWE-295"],"references":["https://access.redhat.com/errata/RHSA-2017:3188","https://access.redhat.com/errata/RHSA-2017:3389","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12195","https://access.redhat.com/errata/RHSA-2017:3188","https://access.redhat.com/errata/RHSA-2017:3389"],"products":["redhat:openshift_container_platform"],"source":"nvd","synced_at":"2026-10-19T20:52:03.425131697+00:00"},"epss":{"cve":"CVE-2017-12195","score":0.01393,"percentile":0.72376,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}