CVE-2023-0813 : A flaw was found in the Network Observability plugin for OpenShift console. Unle

A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.

Published 2023-09-15 21:15:09

Updated 2024-05-03 16:15:10

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2023-0813

Redhat » Network Observability » Version: 1.0
cpe:2.3:a:redhat:network_observability:1.0:*:*:*:*:*:*:*
Matching versions
When used together with: Redhat » Enterprise Linux » Version: 8.0

Exploit prediction scoring system (EPSS) score for CVE-2023-0813

EPSS FAQ

0.13%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 48 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-0813

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
8.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	3.9	4.0	Red Hat, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: None Availability: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	Red Hat, Inc.	2024-05-03
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2023-0813

CWE-285 Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Assigned by: secalert@redhat.com (Secondary)
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-0813

https://access.redhat.com/security/cve/CVE-2023-0813

CVE-2023-0813- Red Hat Customer Portal
Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:0786

RHSA-2023:0786 - Security Advisory - Red Hat Customer Portal
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2169468

2169468 – (CVE-2023-0813) CVE-2023-0813 network-observability-console-plugin-container: setting Loki authToken configuration to DISABLE or HOST mode leads to authentication longer being enforced
Issue Tracking;Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-0813

Products affected by CVE-2023-0813

Exploit prediction scoring system (EPSS) score for CVE-2023-0813

CVSS scores for CVE-2023-0813

CWE ids for CVE-2023-0813

References for CVE-2023-0813