CVE-2023-0833 : A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp c

A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular permissions.

Published 2023-09-27 15:16:03

Updated 2023-10-02 19:26:25

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2023-0833

Redhat » A-mq Streams
Versions before (<) 2.2.1
cpe:2.3:a:redhat:a-mq_streams:*:*:*:*:*:*:*:*
Matching versions
Redhat » A-mq Streams
Versions from including (>=) 2.3.0 and before (<) 2.4.0
cpe:2.3:a:redhat:a-mq_streams:*:*:*:*:*:*:*:*
Matching versions
Squareup » Okhttp
Versions before (<) 4.9.2
cpe:2.3:a:squareup:okhttp:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-0833

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 23 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-0833

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
4.7	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N	1.0	3.6	Red Hat, Inc.
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2023-0833

CWE-209 Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-0833

https://access.redhat.com/errata/RHSA-2023:3223

RHSA-2023:3223 - Security Advisory - Red Hat Customer Portal
Third Party Advisory
https://github.com/square/okhttp/issues/6738

Exception for bad header can leak an Authorization secret · Issue #6738 · square/okhttp · GitHub
Exploit;Issue Tracking;Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2169845

2169845 – (CVE-2023-0833) CVE-2023-0833 Red Hat A-MQ Streams: component version with information disclosure flaw
Issue Tracking;Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-0833

CVE-2023-0833- Red Hat Customer Portal
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:1241

RHSA-2023:1241 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

Jump to

Vulnerability Details : CVE-2023-0833

Products affected by CVE-2023-0833

Exploit prediction scoring system (EPSS) score for CVE-2023-0833

CVSS scores for CVE-2023-0833

CWE ids for CVE-2023-0833

References for CVE-2023-0833