CVEvulnerability

CVE-2023-0813

7.5 HIGH Published 2023-09-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-09-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-285, CWE-287

Description

A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.

Affected configurations

• redhat network observability 1.0

Related

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-287 Improper Authentication weakness

References