exploitDog

CVE-2023-0813

Опубликовано: 13 фев. 2023

Источник: redhat

CVSS3: 7.5

EPSS Низкий

Описание

A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.

Ссылки на источники

Дополнительная информация

Статус:

Important

Дефект:

CWE-287->CWE-285

https://bugzilla.redhat.com/show_bug.cgi?id=2169468network-observability-console-plugin-container: setting Loki authToken configuration to DISABLE or HOST mode leads to authentication longer being enforced

EPSS

Процентиль: 30%

0.00113

Низкий

7.5 High

CVSS3

Связанные уязвимости

CVE-2023-0813

CVSS3: 7.5

nvd

больше 2 лет назад

A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.

GHSA-gpxp-4wx2-cqfw

CVSS3: 8.6

github

больше 2 лет назад

A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.

EPSS

Процентиль: 30%

0.00113

Низкий

7.5 High

CVSS3