CVE-2023-0813

Network-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to authentication longer being enforced

State: Published
Severity: 7.5 High
Published: Sep 15, 2023
Updated: Sep 25, 2024
Reserved: Feb 13, 2023

Read the record on cve.org

Description

A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	redhat

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
github.com/netobserv/network-observability-console-plugin	3badecfc675f63d7f497c4d86c296a0b9ac267e7 and laterNot affected
NETWORK-OBSERVABILITY-1.1.0-RHEL-8Red Hat	v1.1.0-10 and laterNot affected

References

RHSA-2023:0786vendor-advisory
https://access.redhat.com/security/cve/CVE-2023-0813vdb-entry
RHBZ#2169468issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.