CVE-2023-3361CWE-200

S3 credentials included when exporting elyra notebook

High · published October 4, 2023

CVSS v3.1
7.7
EPSS
0%
Percentile
39.7
In the wild
Unconfirmed
What it is

A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster (ds pipeline server) and saves them in plain text in the generated output instead of an ID for a Kubernetes secret.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00470 · 39.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-10-04T11:34Z
EPSS history
Timeline
  • 04 OCT 11:34Z
    S3 credentials included when exporting elyra notebook
    cvelistv5