Lucene search

K
cvelistRedhatCVELIST:CVE-2023-5056
HistoryDec 18, 2023 - 1:43 p.m.

CVE-2023-5056 Skupper-operator: privelege escalation via config map

2023-12-1813:43:07
CWE-862
redhat
www.cve.org
skupper-operator
privilege escalation
config map
unauthorized viewing
authenticated attacker
adjacent cluster
deployments
namespaces

6.8 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.8%

A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user’s purview.

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "Service Interconnect 1 for RHEL 9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "service-interconnect/skupper-config-sync-rhel9",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "1.4.3-5",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:service_interconnect:1::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Service Interconnect 1 for RHEL 9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "service-interconnect/skupper-flow-collector-rhel9",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "1.4.3-5",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:service_interconnect:1::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Service Interconnect 1 for RHEL 9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "service-interconnect/skupper-operator-bundle",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "1.4.3-6",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:service_interconnect:1::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Service Interconnect 1 for RHEL 9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "service-interconnect/skupper-router-rhel9",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "2.4.3-3",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:service_interconnect:1::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Service Interconnect 1 for RHEL 9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "service-interconnect/skupper-service-controller-rhel9",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "1.4.3-4",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:service_interconnect:1::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Service Interconnect 1 for RHEL 9",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "service-interconnect/skupper-site-controller-rhel9",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "1.4.3-6",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:service_interconnect:1::el9"
    ]
  }
]

6.8 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.8%

Related for CVELIST:CVE-2023-5056