CVE-2023-0923CWE-862

Odh-notebook-controller-container: missing authorization allows for file contents disclosure

High · published September 15, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
60.5
In the wild
Unconfirmed
What it is

A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00937 · 60.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2023-09-15T20:16Z
EPSS history
Timeline
  • 15 SEP 20:16Z
    Odh-notebook-controller-container: missing authorization allows for file contents disclosure
    cvelistv5