{"cve":"CVE-2020-25688","nvd":{"published":"2020-11-23T22:15:12.180","modified":"2026-06-17T03:07:07.940","status":"Modified","description":"A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal to a cluster, they could use the private key to decode API requests that should be protected by TLS sessions, potentially obtaining information they would not otherwise be able to. These certificates are not used for service authentication, so no opportunity for impersonation or active MITM attacks were made possible.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":3.5},"cwes":["CWE-798","CWE-321"],"references":["https://bugzilla.redhat.com/show_bug.cgi?id=1892551","https://bugzilla.redhat.com/show_bug.cgi?id=1892551"],"products":["redhat:advanced_cluster_management_for_kubernetes"],"source":"nvd","synced_at":"2026-10-19T21:11:20.317016139+00:00"},"epss":{"cve":"CVE-2020-25688","score":0.00251,"percentile":0.16576,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}