Lucene search

MitreCVE-2023-24619

HistoryFeb 13, 2023 - 7:15 p.m.

CVE-2023-24619

2023-02-1319:15:11

CWE-522

mitre

web.nvd.nist.gov

110

redpanda

aws credentials

cleartext

vulnerability

nvd

cve-2023-24619

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

Percentile

5.1%

JSON

Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versions are 22.3.12, 22.2.10, and 22.1.12.

Affected configurations

Nvd

Node

redpandaredpandaRange22.1.0–22.1.12

redpandaredpandaRange22.2.0–22.2.10

redpandaredpandaRange22.3.0–22.3.12

VendorProductVersionCPE
redpandaredpanda*cpe:2.3:a:redpanda:redpanda:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redpanda	redpanda	*	cpe:2.3:a:redpanda:redpanda::::::::

References

github.com/redpanda-data/redpanda/pull/8339

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2023-24619