CVE-2023-0813

Опубликовано: 15 сент. 2023

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.

Ссылки

https://access.redhat.com/errata/RHSA-2023:0786
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-0813
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2169468
Issue Tracking
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:0786
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-0813
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2169468
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:redhat:network_observability:1.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 30%

0.00113

Низкий

7.5 High

CVSS3

Дефекты

CWE-285

CWE-287

Связанные уязвимости

CVE-2023-0813

CVSS3: 7.5

redhat

почти 3 года назад

GHSA-gpxp-4wx2-cqfw

CVSS3: 8.6

github

больше 2 лет назад