CVE-2023-0813CWE-285

Network-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to authentication longer being enforced

High · published September 15, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
57.9
In the wild
Unconfirmed
What it is

A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00854 · 57.9th percentile
Weakness
CWE-285 · Improper Authorization
Published
2023-09-15T20:17Z
EPSS history
Timeline
  • 15 SEP 20:17Z
    Network-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to authentication longer being enforced
    cvelistv5