Design/Logic Flaw

2023-12-1814:15:00

PRIOn knowledge base

www.prio-n.com

skupper operator

unauthorized access

service account

6.4 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.8%

JSON

A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user’s purview.

CPENameOperatorVersion
service_interconnecteq1.0

CPE	Name	Operator	Version
	service_interconnect	eq	1.0

References

access.redhat.com/errata/RHSA-2023:6219

access.redhat.com/security/cve/CVE-2023-5056

bugzilla.redhat.com/show_bug.cgi?id=2239517