Auth bypass in Red Hat Service Interconnect 1 For Rhel 9
CVE-2023-5056
A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user's purview.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (17.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 18th percentile — 17.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Red Hat Service Interconnect 1 For Rhel 9 — versions 1.4.3-5, 1.4.3-6, 2.4.3-3
- Red Hat Enterprise Linux — versions 9.0
- Red Hat Service Interconnect — versions 1.0
Weakness classification (CWE)
References
- access.redhat.com/errata/RHSA-2023:6219 (vendor-advisory, Vendor Advisory)
- access.redhat.com/security/cve/CVE-2023-5056 (vdb-entry, Vendor Advisory)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking, Issue Tracking)
Frequently asked questions
- What is CVE-2023-5056?
- CVE-2023-5056 is a medium-severity vulnerability in Red Hat Service Interconnect 1 For Rhel 9, classified under Missing Authorization. CVSS score: 6.8/10. Published 2023-12-18.
- How severe is CVE-2023-5056?
- Medium severity. CVSS v3 base score is 6.8 out of 10.